Bulk catalog export (keyed, CC BY 4.0)

The full served catalog as one gzipped JSONL, one object per non-withdrawn CVE with identity, scores (CVSS/EPSS), exploitation (KEV/ransomware), the four detection-content flags with Nuclei/Metasploit references, has_fix, exploit-code flags, tier and description snippet. Rebuilt nightly from the same computations /metrics publishes, so the export cannot disagree with the site. Fetch manifest.json (tiny) first and compare sha256 before pulling the blob (~30 MB). Counts as one request against the key's daily limit. The key is attribution, not a paywall, the data is CC BY 4.0. ?as_of=YYYY-MM-DD (historical snapshots) is reserved for non-free tiers. New in 1.4.0: packages.jsonl.gz, the OSS package↔CVE mapping (one object per cve/ecosystem/package) with OSV version ranges verbatim (ranges[].fixed = upgrade targets; ranges[].affected_through = last vulnerable version, so upgrade past it), plus KEV/EPSS/severity per row; described by the same manifest.json under its packages key. New in 1.5.2: kcv-watch.jsonl.gz, the KCV Watch chain candidates of every tier (the site lists A and B; tier C is here and over /api/kcv-watch.json), one pair per line with the tier, bridge, grade, entry step, caption, both CVEs' KEV, EPSS and publication facts and the extraction provenance; rebuilt nightly, described by its own data_exports pointer. New in 1.7.0: cvss_score, cvss_version and severity are the one score the catalog lists for the CVE, and cvss_source names who gave it (nvd, cna or the ADP's short name); manifest fields_version moves to 5. New in 1.8.0: that score follows the tiered policy of the CVE record's scores.best (the CNA when the CVE Program lists it as a vendor or open-source organization, then NVD, then CISA ADP, then any other CNA, then other ADPs).