The CVEs API from Feedly — 2 operation(s) for cves.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/feedly-cves-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.2.0
info:
title: Feedly CV Es API
version: '1.0'
description: 'Operations tagged CVEs across 2 of this provider''s published API definitions: feedly-ti-endpoints-openapi.yml, feedly-vulnerability-agent-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.feedly.com/v3
tags:
- name: CVEs
paths:
/entities/{entityId}/timeline:
get:
summary: Get CVE Timeline
description: Returns a chronological list of significant events for a given CVE entity, including CVSS score changes, exploitation reports, vendor advisories, threat intelligence reports, and relationship discoveries.
operationId: getCveTimeline
tags:
- CVEs
parameters:
- name: entityId
in: path
required: true
description: The entity ID of the vulnerability (e.g. `vulnerability/m/entity/CVE-2026-5426`). URL-encode the slashes when calling the API directly.
schema:
type: string
example: vulnerability/m/entity/CVE-2026-5426
security:
- bearerAuth: []
responses:
'200':
description: Successful response containing the timeline events for the CVE.
content:
application/json:
schema:
$ref: '#/components/schemas/TimelineResponse'
example:
events:
- id: 3c4e29c3-4b44-53ff-82ba-d4a4d6168c5c
type: vulnerability:cvssScoreUpdate
ts: 1779819616428
updated: 1779819617623
score: 9.1
sourceName: nvd
update: true
- id: fda26aa1-797a-527a-826d-96cf9a7ad27e
type: trending
ts: 1779772863686
updated: 1779772863959
trending: true
- id: b19cc6f5-3b38-5a18-9f6c-dde26c6f450e
type: relationship:cveExploit
ts: 1779707315859
updated: 1779707342615
cveId: vulnerability/m/entity/CVE-2026-5426
entryId: BWEgUuMGzJZRGS6YxA9VWNYmgyVV7cj7FVDMsTGdIdY=_19e5ed28693:2fde63a:8dcaf9bf
sourceName: OTX Bot
threatId: nlp/f/entity/gz:mal:1a1d3ea4-972e-4c48-8d85-08d9db8f1550
threatLabel: Cobalt Strike
'401':
description: Missing or invalid authorization token.
'404':
description: Entity not found.
servers:
- url: https://api.feedly.com/v3
/trends/vulnerability-dashboard:
post:
summary: Vulnerability Agent
description: "Query the Vulnerability Agent.\n\n**How to get your query JSON**: Open any saved or ad-hoc Vulnerability Agent search in the Feedly UI and click the **API** button at the top of the page. Feedly generates the complete JSON payload for you — paste it directly into the request body. You do not need to construct the body manually.\n\n**Custom time windows**: Use `\"type\": \"Custom\"` with full ISO 8601 datetimes for `start` and `end` to poll on any cadence (e.g. every 4 hours) without overlapping bucket boundaries. This is useful for automated workflows (SOAR, SIEM) so each poll returns only new records with no overlap.\n\n**Request body fields**:\n- `layers` (array) — ordered filter layers; filters within a layer are\n OR'd, layers are AND'd together\n\n- `layers[].filters[].field` — filter dimension: `period`, `trending`,\n `created`, `exploited`, `poc`, `weaponized`, `inCisaKev`, `cvssScore`,\n `cvssEstimate`, `cvssVector`\n\n- `layers[].filters[].value` — value depends on field:\n period → `{\"type\": \"Last7Days\"|\"Last30Days\"|\"Last3Months\"|\"Last6Months\"|\"Custom\", \"label\": \"...\", \"start\": \"ISO datetime\", \"end\": \"ISO datetime\"}`;\n cvssScore → `{\"gte\": 9}`;\n cvssEstimate → `\"HIGH\"|\"MEDIUM\"|\"LOW\"`;\n cvssVector → string component e.g. `\"AV:N\"`, `\"PR:N\"`, `\"UI:N\"`;\n boolean fields → `true`\n\n- `count` (integer, optional) — max results per page\n- `continuation` — pagination token from the previous response\n- `sort` — `{\"field\": \"cveId\"|\"cvssScore\"|\"epssScore\"|\"publishedDate\", \"order\": \"asc\"|\"desc\"}`\n"
operationId: getVulnerabilityAgent
tags:
- CVEs
requestBody:
content:
application/json:
schema:
type: object
properties:
RAW_BODY:
type: string
format: json
description: "Body of the request: the JSON query exported from the Feedly UI. Click the **API** button on any Vulnerability Agent search page — Feedly generates the complete JSON payload. Paste it here directly.\n\n**Custom time windows**: Use `\"type\": \"Custom\"` with ISO 8601 datetimes for `start` and `end` to poll on any cadence without overlapping bucket boundaries.\n\nExample:\n\n```json\n{\n \"layers\": [\n {\n \"filters\": [\n {\n \"field\": \"period\",\n \"value\": {\n \"type\": \"Custom\",\n \"start\": \"2026-06-11T02:00:00.000Z\",\n \"end\": \"2026-06-11T06:00:00.000Z\"\n }\n }\n ]\n },\n {\n \"filters\": [\n { \"field\": \"exploited\", \"value\": true },\n { \"field\": \"inCisaKev\", \"value\": true },\n { \"field\": \"weaponized\", \"value\": true }\n ]\n }\n ]\n}\n```\n"
examples:
last7Days:
summary: Last 7 days — trending, high severity
value:
layers:
- filters:
- field: period
value:
type: Last7Days
label: Last 7 Days
- filters:
- field: trending
value: true
- filters:
- field: cvssScore
value:
gte: 9
- field: cvssEstimate
value: HIGH
sort:
field: cveId
order: desc
last3Months:
summary: Last 3 months — exploited, weaponized, or in CISA KEV
value:
layers:
- filters:
- field: period
value:
type: Last3Months
label: Last 3 months
- filters:
- field: trending
value: true
- filters:
- field: created
value: true
- filters:
- field: exploited
value: true
- field: poc
value: true
- field: weaponized
value: true
- field: inCisaKev
value: true
- filters:
- field: cvssScore
value:
gte: 9
- field: cvssEstimate
value: HIGH
- filters:
- field: cvssVector
value: AV:N
- filters:
- field: cvssVector
value: PR:N
- filters:
- field: cvssVector
value: UI:N
customWindow:
summary: Custom time window (for automated polling)
value:
count: 50
layers:
- filters:
- field: period
value:
type: Custom
start: '2026-06-11T02:00:00.000Z'
end: '2026-06-11T06:00:00.000Z'
responses:
'200':
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/VulnerabilityDashboardResponse'
'400':
description: Bad request — malformed query body
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Unauthorized — missing or invalid API key
security:
- bearerAuth: []
servers:
- url: https://api.feedly.com/v3
components:
schemas:
TimelineEvent:
type: object
description: A single timeline event. The fields present depend on the `type`.
required:
- id
- type
- ts
- updated
properties:
id:
type: string
format: uuid
description: Unique identifier for the event.
type:
type: string
description: The event type.
enum:
- vulnerability:cvssScoreUpdate
- vulnerability:cvssScoreEstimation
- vulnerability:cveAssigned
- vulnerability:exploitation
- vulnerability:vendorAdvisory
- relationship:cveExploit
- threatIntelligenceReport
- trending
- firstArticle
ts:
type: integer
format: int64
description: Event timestamp in milliseconds since epoch.
updated:
type: integer
format: int64
description: Last updated timestamp in milliseconds since epoch.
score:
type: number
description: CVSS score. Present on `vulnerability:cvssScoreUpdate` events.
example: 9.1
cvssCategoryEstimate:
type: string
description: Feedly's estimated severity category. Present on `vulnerability:cvssScoreEstimation` events.
example: HIGH
sourceName:
type: string
description: Name of the source that triggered the event.
example: nvd
update:
type: boolean
description: Whether this is an update to a previously set value. Present on score and advisory events.
trending:
type: boolean
description: Whether the CVE is trending. Present on `trending` events.
entryId:
type: string
description: Feedly entry ID of the article associated with the event.
url:
type: string
format: uri
description: URL of the source article or advisory.
vendorName:
type: string
description: Name of the vendor that issued the advisory. Present on `vulnerability:vendorAdvisory` events.
advisoryId:
type: string
description: Advisory identifier. Present on `vulnerability:vendorAdvisory` events.
cveId:
type: string
description: Feedly entity ID of the CVE. Present on `relationship:cveExploit` events.
threatId:
type: string
description: Feedly entity ID of the related threat (malware or threat actor). Present on `relationship:cveExploit` events.
threatLabel:
type: string
description: Human-readable name of the related threat. Present on `relationship:cveExploit` events.
summary:
type: string
description: AI-generated summary of the threat intelligence report. Present on `threatIntelligenceReport` events.
TimelineResponse:
type: object
properties:
events:
type: array
description: List of timeline events, ordered from most recent to oldest.
items:
$ref: '#/components/schemas/TimelineEvent'
PatchDetail:
type: object
properties:
title:
type: string
example: Github Advisory
source:
type: string
description: Source database (e.g. `github_advisories`, `nvd`).
example: github_advisories
url:
type: string
format: uri
patchAddedDate:
type: string
format: date-time
description: When this patch was published by the source.
feedlyPatchAddedDate:
type: string
format: date-time
description: When Feedly first indexed this patch.
ExploitDetail:
type: object
description: 'A classified exploit entry produced by Feedly''s exploit analyzer (Claude Haiku). Each URL associated with a CVE is automatically classified with a label, confidence score, and supporting evidence.
'
properties:
url:
type: string
format: uri
description: URL to the exploit or PoC resource.
source:
type: string
description: Source that surfaced this URL (e.g. `PoC-in-GitHub`, `nvd`).
example: PoC-in-GitHub
language:
type:
- string
- 'null'
description: Primary programming language detected in the repository.
example: Python
label:
type: string
description: 'Classification label assigned by Feedly''s exploit analyzer. `is_real_exploit` is `true` for `exploit_code` and `exploit_steps` only.
'
enum:
- exploit_code
- exploit_steps
- poc_code
- poc_steps
- detection
- advisory
- empty
- unknown
example: detection
is_real_exploit:
type: boolean
description: '`true` when label is `exploit_code` or `exploit_steps` — i.e. the content can compromise a real system, not just demonstrate or detect the vulnerability.
'
confidence:
type: string
description: 'Classifier confidence. `download_urls` and `inline_snippets` are only populated when confidence is `high` and the label is actionable (`exploit_code`, `exploit_steps`, `poc_code`, `poc_steps`, `detection`).
'
enum:
- high
- medium
- low
example: high
reason:
type: string
description: Human-readable explanation of the classification decision.
key_evidence:
type: string
description: Specific evidence excerpt that drove the classification.
download_urls:
type: array
description: 'Raw/fetchable URLs for exploit files. Only populated when `confidence` is `high` and the label is actionable.
'
items:
type: string
format: uri
inline_snippets:
type: array
description: 'Code blocks extracted from the content. Only populated when `confidence` is `high` and the label is actionable.
'
items:
type: object
properties:
language:
type: string
example: python
code:
type: string
example: 'import socket
...'
classification_model:
type: string
description: The model used to classify this exploit entry.
example: claude-haiku-4-5-20251001
classification_duration_ms:
type: integer
description: Time taken to classify, in milliseconds.
example: 1340
exploitAddedDate:
type: string
format: date-time
description: When this exploit URL was first associated with the CVE.
exploitUpdatedDate:
type: string
format: date-time
description: When the exploit classification was last updated.
Vulnerability:
type: object
properties:
id:
type: string
description: Feedly entity ID for this CVE.
example: vulnerability/m/entity/CVE-2026-50751
cveid:
type: string
description: CVE identifier.
example: CVE-2026-50751
type:
type: string
example: vulnerability
label:
type: string
example: CVE-2026-50751
hasSalience:
type: boolean
description: Whether Feedly has determined this CVE is editorially significant.
description:
type: string
description: 'Vulnerability description. For CVEs discovered by Feedly before MITRE/NVD publication, this may be a placeholder such as "The CVE description is not yet available but Feedly AI found some discussions about it." Replaced automatically as the CVE progresses through the pipeline.
'
cveStatus:
type:
- string
- 'null'
description: 'Official standing of the CVE in MITRE/NVD at the time of the last status check. Use `Analyzed` or `Modified` for fully actionable entries. Include `Received`, `Awaiting Analysis`, and `Undergoing Analysis` for early-warning coverage. Exclude `Likely Rejected` and `Rejected` for production alerting. `null` indicates a legacy entry that predates this field.
'
enum:
- Received
- Awaiting Analysis
- Undergoing Analysis
- Analyzed
- Modified
- Deferred
- Reserved
- Rejected
- Unknown
- Likely Rejected
example: Received
advisoryUrl:
type: string
format: uri
description: Primary advisory or reference URL.
cvssV3:
$ref: '#/components/schemas/CvssV3'
cvssCategoryEstimate:
type: string
description: 'Feedly''s AI-estimated severity when an official CVSS score is unavailable.
'
enum:
- HIGH
- MEDIUM
- LOW
example: HIGH
cweIds:
type: array
items:
$ref: '#/components/schemas/CweId'
epssScore:
type: string
description: EPSS probability of exploitation (0–1, as a string).
example: '0.137310000'
trending:
type: boolean
description: Whether this CVE is currently trending in Feedly.
patched:
type: boolean
description: Whether a patch is available.
patchDetails:
type: array
items:
$ref: '#/components/schemas/PatchDetail'
exploits:
type: array
description: 'Classified exploit objects for this CVE. Each entry is produced by Feedly''s exploit analyzer (Claude Haiku) and carries a label, confidence score, and supporting evidence. See `overall_label` for a quick CVE-level signal without iterating this array.
'
items:
$ref: '#/components/schemas/ExploitDetail'
newExploits:
type: array
description: 'Legacy field — enriched exploit entries from the previous classification pipeline. See `exploits` for the current format.
'
items:
$ref: '#/components/schemas/ExploitDetail'
exploit_count:
type: integer
description: Total number of exploit URLs associated with this CVE.
example: 2
overall_label:
type: string
description: 'Highest-severity classification across all exploit entries for this CVE. Use this to quickly identify CVEs with `exploit_code` or `exploit_steps` without iterating the full `exploits` array.
'
enum:
- exploit_code
- exploit_steps
- poc_code
- poc_steps
- detection
- advisory
- empty
- unknown
example: exploit_code
proofOfExploits:
type: array
description: URLs to articles or posts confirming in-the-wild exploitation.
items:
type: string
format: uri
proofOfConcepts:
type: array
description: URLs to public proof-of-concept resources.
items:
type: string
format: uri
exploitedAt:
type: array
description: Unix epoch millisecond timestamps of known exploitation events.
items:
type: integer
example:
- 1728924420139
urlReferenceCount:
type: integer
description: Number of URLs referencing this CVE across Feedly's sources.
example: 25
graphUrl:
type: string
format: uri
description: URL to a full-size trend graph image for this CVE.
smallGraphUrl:
type: string
format: uri
description: URL to a small trend graph image for this CVE.
feedlyInsertedDate:
type: string
format: date-time
description: When Feedly first indexed this CVE.
example: '2024-01-24T15:49:00.439865+00:00'
feedlyUpdatedDate:
type: string
format: date-time
description: When Feedly last updated this CVE.
example: '2024-12-03T23:39:55.341856+00:00'
publishedDate:
type: string
format: date-time
description: Original NVD/MITRE publication date.
example: '2024-01-24T00:00:00+00:00'
publicationDateInfo:
type: array
description: Detailed publication date metadata.
items:
type: object
additionalProperties: true
executiveSummary:
$ref: '#/components/schemas/ExecutiveSummary'
relationships:
type: array
description: Related threat entities (threat actors, malware, TTPs, etc.).
items:
type: object
additionalProperties: true
timeline:
type: array
description: 'Chronological events for this CVE (CVSS changes, exploitation reports, vendor advisories, relationship discoveries).
'
items:
type: object
additionalProperties: true
affectedProducts:
type: array
description: List of products confirmed affected by this CVE.
items:
type: object
additionalProperties: true
vulnerableProducts:
type: object
description: Summary of vulnerable products.
additionalProperties: true
affectedProductsEstimate:
type: array
description: Estimated list of affected products when confirmed data is unavailable.
items:
type: object
additionalProperties: true
idMapping:
type: array
description: Related threat IDs from external sources.
items:
type: object
additionalProperties: true
detectedBy:
type: array
description: Scanner detection information (vendor-specific identifiers).
items:
type: object
additionalProperties: true
ScalarAggregation:
type: object
description: A single count aggregation (no breakdown by bucket).
properties:
name:
type: string
example: exploited
total:
type: integer
example: 34
VulnerabilityDashboardResponse:
type: object
properties:
total:
type: integer
description: Total number of vulnerabilities matching the query.
example: 38
continuation:
description: 'Pass this value back as `continuation` in the next request to retrieve the next page of results. Absent when there are no more pages.
'
oneOf:
- type: string
- type: array
items: {}
example:
- 2026
- 20182
- vulnerability/m/entity/CVE-2026-20182
vulnerabilities:
type: array
items:
$ref: '#/components/schemas/Vulnerability'
aggregations:
$ref: '#/components/schemas/Aggregations'
ExecutiveSummary:
type: object
description: 'AI-generated executive summary for the vulnerability. Fields are written for a non-technical audience.
'
properties:
impact:
type: string
description: Plain-language description of what an attacker could do.
example: An attacker exploiting this vulnerability could...
exploitation:
type: string
description: Current exploitation status and public PoC availability.
example: There is no evidence that a public proof-of-concept exists...
description:
type: string
description: Brief summary of the vulnerability.
patch:
type: string
description: Patch availability and version information.
example: A patch is available. Firefox versions 131.0.3...
mitigation:
type: string
description: Recommended mitigation steps.
example: Update Firefox to version 131.0.3 or later.
processing_time_s:
type: number
description: Time taken to generate the summary, in seconds.
example: 8.203333
BucketAggregation:
type: object
description: Aggregation broken down by individual entities.
properties:
name:
type: string
example: vendors
buckets:
type: array
items:
$ref: '#/components/schemas/AggregationBucket'
CvssV3:
type: object
description: CVSS v3.x base score and vector components.
properties:
version:
type: string
example: '3.1'
baseScore:
type: number
example: 9.3
vectorString:
type: string
example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
attackVector:
type: string
enum:
- NETWORK
- ADJACENT_NETWORK
- LOCAL
- PHYSICAL
example: NETWORK
attackComplexity:
type: string
enum:
- LOW
- HIGH
example: LOW
privilegesRequired:
type: string
enum:
- NONE
- LOW
- HIGH
example: NONE
userInteraction:
type: string
enum:
- NONE
- REQUIRED
example: NONE
scope:
type: string
enum:
- UNCHANGED
- CHANGED
example: CHANGED
confidentialityImpact:
type: string
enum:
- NONE
- LOW
- HIGH
example: HIGH
integrityImpact:
type: string
enum:
- NONE
- LOW
- HIGH
example: LOW
availabilityImpact:
type: string
enum:
- NONE
- LOW
- HIGH
example: NONE
ErrorResponse:
type: object
properties:
errorCode:
type: integer
errorId:
type: string
message:
type: string
CweId:
type: object
properties:
cweID:
type: string
example: CWE-287
name:
type: string
example: Improper Authentication
AggregationBucket:
type: object
properties:
id:
type: string
description: 'Entity ID or short key. `__others__` represents all entities beyond the top N returned.
'
example: nlp/f/entity/gz:mal:8071f2d8-cc44-4682-845b-6f39a9f8b587
label:
type: string
example: Clop
total:
type: integer
example: 1
Aggregations:
type: object
description: 'Facet counts for the full result set. Useful for building filter UIs or summary dashboards.
'
properties:
weaponized:
$ref: '#/components/schemas/ScalarAggregation'
exploited:
$ref: '#/components/schemas/ScalarAggregation'
vendors:
$ref: '#/components/schemas/BucketAggregation'
malwareFamilies:
$ref: '#/components/schemas/BucketAggregation'
threatActors:
$ref: '#/components/schemas/BucketAggregation'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: Feedly API token (format `fe_...`)
x-refined-from:
- feedly-ti-endpoints-openapi.yml
- feedly-vulnerability-agent-openapi.yml
x-readme:
explorer-enabled: true
proxy-enabled: true