CVE Security Kev Watch.json API

openapi: 3.2.0
info:
  title: Cve Security Com Kev Watch.json API
  version: 1.9.1
  contact:
    url: https://cve-security.com/api
  license:
    name: 'Scoreboard data: CC BY 4.0. Underlying sources retain their own licenses (see /sources).'
    identifier: CC-BY-4.0
  description: 'Operations tagged Kev Watch.json across 2 of this provider''s published API definitions: cve-security-com-openapi.json, cve-security-com-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://cve-security.com
tags:
- name: Kev Watch.json
paths:
  /api/kev-watch.json:
    get:
      operationId: getKevWatch
      summary: 'KEV Watch: CVEs reported exploited outside CISA KEV'
      description: 'CVEs that VulnCheck KEV, VulnCheck canaries, Microsoft MSRC, Google Project Zero, ENISA EU KEV, CIRCL sightings or FortiGuard report as exploited while they remain outside CISA KEV, ranked by a published point table. Every row carries its reports (source, date, URL), its evidence pattern and, for the 90 days after its first report and where at least 40 similar CVEs exist, the measured share of that pattern CISA listed within 90 days. A tier is paged with limit and page, and total is the tier''s row count. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community).'
      security:
      - bearer: []
      - apiKey: []
      parameters:
      - name: tier
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 4
        description: 1 strongest, 3 every other reported CVE, 4 rising risk without a claim; default tiers 1–2. tier_rule in the response names the rule in force.
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 500
          default: 100
      - name: page
        in: query
        schema:
          type: integer
          minimum: 1
          default: 1
        description: Pages of limit rows; has_more says when another page follows
      responses:
        '200':
          description: '{ generated, tier, page, count, total, has_more, attribution[], note, tier_rule: {rule, recent_days, text}, recall, points, rows: [{cve_id, url, tier, score, claims[], first_claim, latest_claim, pattern, pattern_rate|null, epss, epss_delta_7d, detectable, has_fix, bdu|null, previdian|null, …}] }. bdu, where a row carries it, holds two fields of BDU (the vulnerability database of FSTEC of Russia, read through CIRCL): incident and exploit, with the record id and its CIRCL address; it stays apart from the claims. previdian, where a row carries it, holds Previdian''s own date for its entry on the CVE (listed) and Previdian''s page (url); it stays apart from the claims as well. A claim date is the source''s own and is null where the dataset holds none; latest_claim is the newest dated report from any tracker.'
        '503':
          description: Not built yet (builds nightly)
      tags:
      - Kev Watch.json
    servers:
    - url: https://cve-security.com
components:
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: 'Authorization: Bearer cvs_live_…'
    apiKey:
      type: apiKey
      in: header
      name: X-API-Key
      description: Alternative to the Authorization header. Keys are never accepted in query strings.
x-refined-from:
- cve-security-com-openapi.json
- cve-security-com-openapi.yml