CVE Security Kcv Watch.json API

openapi: 3.2.0
info:
  title: Cve Security Com Kcv Watch.json API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Kcv Watch.json across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Kcv Watch.json
paths:
  /api/kcv-watch.json:
    get:
      operationId: getKcvWatch
      summary: 'KCV Watch: possible exploit chains for teams to research'
      description: 'Chain candidates: pairs of CVEs whose extracted exploit capabilities connect, one step feeding the next, or whose records tie them together (exploitation reports or field sightings on both within 90 days, an authentication bypass disclosed with a partner under one narrow advisory or fix, or two products that CISA, a CNA or community sources tie together), derived from exploit-capability analysis by the CVE Security intelligence team. Three tiers defined by a likelihood band: pairs with these signals are estimated as possible chains at a rate of at least one in 25 (A), one in 100 (B) or one in 1,000 (C); the estimate is counted against cited chains on pairs whose later CVE is at least 90 days old. A pair reaches tier A only when the capability analysis documents a handoff between the two CVEs, and a pair of two products reaches at most tier B. The site''s pages list tiers A and B; tier C is returned here (tier=C), on each CVE record under chains.candidates and in the download /api/export/kcv-watch.jsonl.gz, one pair per line, rebuilt nightly. Each row carries listed_on_site. The capabilities of every CVE with a CVSS vector come from a fixed rule over the vector, the weakness class and the description, joined with a model''s reading of exploit code and patch diffs where the dataset holds them. Every row carries both CVEs with KEV status, EPSS and publication date, the tier and its rule, the lane, the reasons, the basis, the product the pair shares with its page, the bridge, the capability-match grade, the entry step where one is extracted and a one-sentence caption. A row carries no rate of its own; a candidate is not a confirmed chain. set=breaking returns Breaking watch in place of the tiers: connected same-product pairs with an exploitation report or field sighting, whatever their tier (null below tier C), each with since and until (the first and last day of its stay, inclusive), its basis, caption and lane; the set is small and comes whole, and the watch adds no rate of its own. Keyed; private-cacheable for 900s.'
      security:
      - bearer: []
      - apiKey: []
      parameters:
      - name: tier
        in: query
        schema:
          type: string
          enum:
          - A
          - B
          - C
        description: One tier; default all three. Tier C rows are not listed on the site; they are here and in the download.
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 2000
          default: 500
        description: At most 2000 rows a call; follow has_more with page (tiers A and B together hold several thousand rows)
      - name: page
        in: query
        schema:
          type: integer
          minimum: 1
          default: 1
      - name: set
        in: query
        schema:
          type: string
          enum:
          - breaking
        description: 'breaking: the Breaking watch dataset in place of the tiers; tier, limit and page are ignored'
      responses:
        '200':
          description: '{ generated, tier, page, count, has_more, tier_rules, attribution, note, rows: [{cve_a{cve_id,url,title,kev,epss,published}, cve_b{…}, entry_cve, entry_reach, entry_reach_words, tier, tier_rule, basis, kev_count, product{key,name,slug,url}|null, products[], bridge, bridge_words, grade, grade_words, from_post, to_pre, explanation, ransomware, discussed, generated}] } With set=breaking: { generated, set, count, rule, note, attribution, rows: [{cve_a{cve_id,url,title,kev}, cve_b{…}, tier (A, B, C or null), since, until, basis[], explanation, lane, kev_count, exploited_count, product{key,name,slug}|null}] }'
        '503':
          description: Not built yet (builds nightly)
      tags:
      - Kcv Watch.json
    servers:
    - url: https://cve-security.com
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml