---
title: "KEV Watch: CVEs reported exploited outside CISA KEV"
method: GET
path: "/api/kev-watch.json"
---

# KEV Watch: CVEs reported exploited outside CISA KEV

`GET /api/kev-watch.json`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/kev-watch.json`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

CVEs that VulnCheck KEV, VulnCheck canaries, Microsoft MSRC, Google Project Zero, ENISA EU KEV, CIRCL sightings or FortiGuard report as exploited while they remain outside CISA KEV, ranked by a published point table. Every row carries its reports (source, date, URL), its evidence pattern and, for the 90 days after its first report and where at least 40 similar CVEs exist, the measured share of that pattern CISA listed within 90 days. A tier is paged with limit and page, and total is the tier's row count. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community).

## Query parameters

- `tier` integer
- `limit` integer
- `page` integer

## Response `200`

{ generated, tier, page, count, total, has_more, attribution[], note, tier_rule: {rule, recent_days, text}, recall, points, rows: [{cve_id, url, tier, score, claims[], first_claim, latest_claim, pattern, pattern_rate|null, epss, epss_delta_7d, detectable, has_fix, bdu|null, previdian|null, …}] }. bdu, where a row carries it, holds two fields of BDU (the vulnerability database of FSTEC of Russia, read through CIRCL): incident and exploit, with the record id and its CIRCL address; it stays apart from the claims. previdian, where a row carries it, holds Previdian's own date for its entry on the CVE (listed) and Previdian's page (url); it stays apart from the claims as well. A claim date is the source's own and is null where the dataset holds none; latest_claim is the newest dated report from any tracker.

## Other responses

- `503`: Not built yet (builds nightly)

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)