KEV Watch: CVEs reported exploited outside CISA KEV
CVEs that VulnCheck KEV, VulnCheck canaries, Microsoft MSRC, Google Project Zero, ENISA EU KEV, CIRCL sightings or FortiGuard report as exploited while they remain outside CISA KEV, ranked by a published point table. Every row carries its reports (source, date, URL), its evidence pattern and, for the 90 days after its first report and where at least 40 similar CVEs exist, the measured share of that pattern CISA listed within 90 days. A tier is paged with limit and page, and total is the tier's row count. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community).
Request
- Base URL: https://cve-security.com
- URL: https://cve-security.com/api/kev-watch.json
- Auth: one of:
- HTTP bearer
- API key in header X-API-Key
Query parameters
1 strongest, 3 every other reported CVE, 4 rising risk without a claim; default tiers 1–2. tier_rule in the response names the rule in force.
Pages of limit rows; has_more says when another page follows
Response
{ generated, tier, page, count, total, has_more, attribution[], note, tier_rule: {rule, recent_days, text}, recall, points, rows: [{cve_id, url, tier, score, claims[], first_claim, latest_claim, pattern, pattern_rate|null, epss, epss_delta_7d, detectable, has_fix, bdu|null, previdian|null, …}] }. bdu, where a row carries it, holds two fields of BDU (the vulnerability database of FSTEC of Russia, read through CIRCL): incident and exploit, with the record id and its CIRCL address; it stays apart from the claims. previdian, where a row carries it, holds Previdian's own date for its entry on the CVE (listed) and Previdian's page (url); it stays apart from the claims as well. A claim date is the source's own and is null where the dataset holds none; latest_claim is the newest dated report from any tracker.
Changes
No recorded changes to this operation across all 1 revision of this API.