Empirical Security

Empirical Security CV Es API

Retrieve CVE detail, scores, malware hashes and history.

GitHub OpenAPI

Operations 6

GET /cves/{cve_id} Retrieve a CVE by identifier #
GET /cves/{cve_id}/malware Retrieve malware hashes for a CVE #
GET /cves/{cve_id}/critical_indicators Retrieve critical indicators for a CVE #
GET /cves/{cve_id}/score_history Retrieve score history for a CVE #
GET /cves/{cve_id}/history Retrieve CVE change history #
GET /cves/all Retrieve all CVEs #

Documentation

📖
Documentation
https://docs.empiricalsecurity.com/
📖
APIReference
https://docs.empiricalsecurity.com/api_reference/cves
📖
Authentication
https://artifacts.apis.io/empirical-security/authentication/empirical-security-authentication.yml

Specifications

⚙
OpenAPI
https://artifacts.apis.io/empirical-security/openapi/empirical-security-cves-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/empirical-security/json-schema/empirical-security-cve-schema.json
📊
JSONSchema
https://artifacts.apis.io/empirical-security/json-schema/empirical-security-score-history-schema.json
📊
JSONSchema
https://artifacts.apis.io/empirical-security/json-schema/empirical-security-malware-hash-schema.json

Other Resources

🔗
OAuthScopes
https://artifacts.apis.io/empirical-security/scopes/empirical-security-scopes.yml
🔗
ErrorCatalog
https://artifacts.apis.io/empirical-security/errors/empirical-security-problem-types.yml
🔗
Conventions
https://artifacts.apis.io/empirical-security/conventions/empirical-security-conventions.yml
🔗
Lifecycle
https://artifacts.apis.io/empirical-security/lifecycle/empirical-security-lifecycle.yml
🔗
Conformance
https://artifacts.apis.io/empirical-security/conformance/empirical-security-conformance.yml
🔗
DataModel
https://artifacts.apis.io/empirical-security/data-model/empirical-security-data-model.yml
🔗
AgenticAccess
https://artifacts.apis.io/empirical-security/agentic-access/empirical-security-agentic-access.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/empirical-security:empirical-security-cves-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

empirical-security-cves-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Empirical Security CVEs API
  version: '1.0'
  description: The Empirical Security API provides programmatic access to real-time exploitation prediction scores for CVEs. It exposes the Foundation (global) model, hourly-updated EPSS models (epss_v3/epss_v4/epss_v5), and organization-specific Radiant models, along with CVE detail, malware-hash, critical-indicator, score-history, change-history, and saved CVE-group endpoints. Authentication is OAuth 2.0 client credentials (JWT bearer).
  contact:
    name: Empirical Security
    url: https://docs.empiricalsecurity.com/
  x-provenance:
    generated: '2026-07-19'
    method: generated
    source: https://docs.empiricalsecurity.com/api_reference/cves, https://docs.empiricalsecurity.com/api_reference/search, https://docs.empiricalsecurity.com/api_reference/cve_groups, https://docs.empiricalsecurity.com/authentication, https://docs.empiricalsecurity.com/errors
servers:
- url: https://app.empiricalsecurity.com/api
  description: Production
security:
- oauth2: []
tags:
- name: CVEs
  description: Retrieve CVE detail, scores, malware hashes and history.
paths:
  /cves/{cve_id}:
    get:
      operationId: getCve
      summary: Retrieve a CVE by identifier
      description: Retrieve full detail and scores for a single CVE by its identifier.
      tags:
      - CVEs
      parameters:
      - $ref: '#/components/parameters/CveId'
      responses:
        '200':
          description: CVE detail
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cve'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/ServerError'
  /cves/{cve_id}/malware:
    get:
      operationId: getCveMalware
      summary: Retrieve malware hashes for a CVE
      description: Retrieve MD5/SHA1/SHA256 malware hashes associated with a CVE.
      tags:
      - CVEs
      parameters:
      - $ref: '#/components/parameters/CveId'
      - name: accept
        in: query
        required: false
        description: Set to application/jsonl for JSON Lines output.
        schema:
          type: string
      responses:
        '200':
          description: Array of malware hash records
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/MalwareHash'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /cves/{cve_id}/critical_indicators:
    get:
      operationId: getCveCriticalIndicators
      summary: Retrieve critical indicators for a CVE
      description: Retrieve the scoring model analysis with weighted critical indicators for a CVE.
      tags:
      - CVEs
      parameters:
      - $ref: '#/components/parameters/CveId'
      responses:
        '200':
          description: Critical indicator analysis
          content:
            application/json:
              schema:
                type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /cves/{cve_id}/score_history:
    get:
      operationId: getCveScoreHistory
      summary: Retrieve score history for a CVE
      description: Retrieve historical scores for a CVE for a given scoring model.
      tags:
      - CVEs
      parameters:
      - $ref: '#/components/parameters/CveId'
      - name: scoring_model
        in: query
        required: true
        description: Scoring model key.
        schema:
          type: string
          enum:
          - global
          - epss_v3
          - epss_v4
          - epss_v5
          - all
      responses:
        '200':
          description: Score history
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScoreHistory'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /cves/{cve_id}/history:
    get:
      operationId: getCveHistory
      summary: Retrieve CVE change history
      description: Retrieve the array of change records (data and diff) for a CVE.
      tags:
      - CVEs
      parameters:
      - $ref: '#/components/parameters/CveId'
      responses:
        '200':
          description: Array of change records
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
  /cves/all:
    get:
      operationId: getAllCves
      summary: Retrieve all CVEs
      description: Retrieve the full CVE dataset. Returns a 302 redirect to a gzipped JSONL file, or 202 when the file is being generated.
      tags:
      - CVEs
      responses:
        '302':
          description: Redirect to gzipped JSONL export file.
        '202':
          description: Export file is being generated; retry later.
        '401':
          $ref: '#/components/responses/Unauthorized'
components:
  schemas:
    Cve:
      type: object
      properties:
        identifier:
          type: string
          example: CVE-2023-49103
        description:
          type: string
        cvss:
          type: array
          items:
            type: object
        references:
          type: array
          items:
            type: object
        has_exploitation_activity:
          type: boolean
        scores:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Score'
    ScoreHistory:
      type: object
      properties:
        identifier:
          type: string
        scores:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/Score'
    MalwareHash:
      type: object
      properties:
        md5:
          type: string
        sha1:
          type: string
        sha256:
          type: string
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: String identifier for the error type.
            message:
              type: string
              description: Human-readable description of the error.
    Score:
      type: object
      properties:
        score:
          type: number
        percentile:
          type: number
        computed_at:
          type: string
          format: date-time
  responses:
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    ServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    Unauthorized:
      description: Authentication failed (missing or invalid token).
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  parameters:
    CveId:
      name: cve_id
      in: path
      required: true
      description: CVE identifier in the format CVE-YYYY-NNNNN.
      schema:
        type: string
        pattern: ^CVE-\d{4}-\d{4,}$
        example: CVE-2023-49103
  securitySchemes:
    oauth2:
      type: oauth2
      description: OAuth 2.0 client credentials flow via FusionAuth. Exchange client ID/secret (HTTP Basic) for a one-hour JWT access token, then send it as a Bearer token.
      flows:
        clientCredentials:
          tokenUrl: https://empiricalsecurity.fusionauth.io/oauth2/token
          scopes:
            target-entity:0c6d5dcc-8bf0-4cd1-bd65-066ef0422369: Access to the Empirical Security tenant/entity's CVE data.