CVE change feed - the CVE records MODIFIED within a time...
CVE change feed — the CVE records MODIFIED within a time window, so an agent can incrementally maintain a vulnerability view instead of re-scanning. Pass since (YYYY-MM-DD or ISO datetime); until defaults to now (window must be ≤ 120 days, the NVD limit). Optionally narrow by keyword (product/text) or cpe (exact CPE). Returns each changed CVE with its id, published + lastModified timestamps, current vulnStatus (e.g. Modified, Analyzed, Rejected), best-available CVSS score/severity, description, and kevListed — whether it is now on the CISA Known-Exploited Vulnerabilities catalog (the high-signal flag for a poller; null when the KEV catalog could not be fetched). Newest modification first. Sourced live from NVD (NIST) + CISA KEV, free/keyless. Pair with security.cve for full per-CVE detail.
Request
- Base URL: https://2s.io
- URL: https://2s.io/api/security/cve-changes
- Auth: API key in header PAYMENT-SIGNATURE
Query parameters
Since.
Until.
Keyword.
Cpe.
Maximum number of results to return.
Try before you buy. Set to 1 for one free real call per endpoint per hour — no wallet or payment needed — to verify the endpoint before paying. Equivalent to sending the "X-2s-Trial: 1" request header. Listed only on operations that offer a trial; the others always answer 402.
Response
Changes
No recorded changes to this operation across all 1 revision of this API.