> For the complete documentation index, see [llms.txt](https://support.attackforge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.attackforge.com/app/modules/ai-mcp-and-skills/find-vulnerabilities.md).
# Find Vulnerabilities
#### Description
This tool can be used to find Vulnerabilities using a provided filter expression.
#### How To Enable
1. Go to `Users`
2. Select the user you would like to provide access to this tool
3. Click on `Access > MCP`
4. Click on `Add Tools`
5. Select the tool `find_vulnerabilities` and click `Add`
#### Example Prompts
```
Which vulnerabilities are currently in Retest status? Include custom fields in the response.
```
#### Supported Query Fields
{% code overflow="wrap" %}
```javascript
id: {
type: 'string',
pattern: "ObjectId\\(\\'[0-9a-fA-F]{24}\\'\\)",
description: "This is the vulnerability id. Match against single id: { id: { $eq: ObjectId('65a440c08cade68ca7bc7192') } }. Match against multiple ids: { id: { $in: [ ObjectId('65a440c08cade68ca7bc7192'), ObjectId('65a440c08cade68ca7bc7192') ] } }",
}
created: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The timestamp that this vulnerability was created.'
},
modified: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The timestamp that this vulnerability was last modified.'
}
title: {
type: 'string',
}
priority: {
enum: [
'Critical',
'High',
'Medium',
'Low',
'Info'
]
}
alternate_id: {
type: 'string',
}
cvssv3_1_score: {
description: 'CVSSv3.1 score',
type: 'number'
}
cvssv3_1_vector: {
description: 'CVSSv3.1 vector string',
type: 'string'
}
status: {
enum: ['Closed', 'Open']
}
status_updated: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The status was last updated at this timestamp.'
}
target_remediation_date: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The latest timestamp at which the vulnerability is planned to be remediated.'
}
likelihood_of_exploitation: {
type: 'integer',
description: 'Scale of exploitability - 1 is least, 10 is most.'
}
steps_to_reproduce: {
type: 'string',
}
release_date: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The timestamp when the vulnerability was marked as released.'
}
sla: {
type: 'string',
pattern: '^\\d{4,}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$',
description: 'The timestamp when the vulnerability is expected to be remediated.'
}
tags: {
type: 'array',
items: { type: 'string' }
}
custom_tags: {
type: 'array',
items: {
type: 'object',
properties: {
name: { type: 'string' },
value: { type: 'string' }
},
required: ['name', 'value'],
additionalProperties: false
}
}
custom_fields: {
type: 'array',
items: {
type: 'object',
properties: {
key: {
type: 'string',
pattern: '^[a-zA-Z]([a-zA-Z0-9_]*[a-zA-Z0-9])?$',
},
value: {
oneOf: [
{
type: 'string',
},
{
type: 'array',
},
]
}
},
required: ['key', 'value'],
additionalProperties: false
}
is_retest: {
enum: ['Yes', 'No'],
description: 'Indicates whether this vulnerability has been marked for retest.'
}
is_zero_day: {
enum: ['Yes', 'No'],
description: 'Indicates whether this vulnerability has been categorised as zero day.'
}
writeup_id: {
type: 'string',
pattern: "ObjectId\\(\\'[0-9a-fA-F]{24}\\'\\)",
description: "This is the Writeup id. Example query: { writeup_id: { $eq: ObjectId('65a440c08cade68ca7bc7192') } }"
}
```
{% endcode %}
#### Example Response
{% code overflow="wrap" %}
```json
{
"data":
[
{
"id": "656168055d7035a12ade4cb3",
"created": "2023-11-25T03:20:37.342Z",
"modified": "2025-05-21T08:54:09.414Z",
"title": "Hosts Respond with Hashes/Challenge-Responses to Spoofed Hostnames",
"priority": "High",
"project_ids":
[
"656158c0965172000f9119e8"
],
"writeup_id": "5b9d9c9296d7402e00f42f8a",
"affected_assets":
[
"682d94b146e588dd33696a46"
],
"status": "Open",
"status_updated": "2023-11-25T03:20:37.342Z",
"target_remediation_date": "2025-05-26T14:00:00.000Z",
"likelihood_of_exploitation": 9,
"steps_to_reproduce": "Run the tool Responder on an active broadcast domain:
{{{start-responder.png}}}
User attempts to search for a share that doesn't exist:
{{{user-mistypes-share.png}}}
View the LLMNR request in Responder:
{{{request-in-responder.png}}}
Get the user’s hashed credentials:
{{{user-hash.png}}}
Crack the hash using a tool such as Hashcat:
{{{cracked-hash.png}}}
",
"release_date": "2023-11-25T03:20:37.362Z",
"sla": "2025-06-19T14:00:00.000Z",
"tags":
[
"CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action",
"CWE-290: Authentication Bypass by Spoofing",
"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"CVSSv3.1 Base Score: 8.1"
],
"cvssv3_1_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"cvssv3_1_score": 8.1,
"custom_tags":
[],
"custom_fields":
[
{
"key": "attack_narrative",
"value": "For this assessment, attackers were placed on the 10.0.9.0/24 network segment.
This attack was executed from host 10.0.9.18.
",
"label": "Attack Narrative"
},
{
"key": "critical_steps",
"value":
[
{
"step": "1",
"details": "Ensure network access is established. Use 'ip a' or 'ifconfig' to confirm."
}
],
"label": "Critical Steps"
},
{
"key": "technical_impact",
"value": "Receive the hash or challenge-response and username of the person using the host, then subject the hashes to an offline password cracking/recovery attack.
",
"label": "Technical Impact"
},
{
"key": "persons_targeted",
"value":
[],
"label": "Persons Targeted"
},
{
"key": "cve",
"value": "CVE-2025-26943",
"label": "CVE"
}
],
"is_retest": "No",
"is_zero_day": "No"
}
],
"count": 50,
"total": 332
}
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://support.attackforge.com/app/modules/ai-mcp-and-skills/find-vulnerabilities.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.