---
title: "Defender Scoreboard data (keyless, CC BY 4.0)"
method: GET
path: "/api/scoreboard/{file}"
---

# Defender Scoreboard data (keyless, CC BY 4.0)

`GET /api/scoreboard/{file}`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/scoreboard/{file}`
- Auth: none declared

The published measurement of exploited vs detectable vs patchable, with the exact CVE list behind every figure. scoreboard.json carries each metric's method and caveats; the CSVs are the evidence and always match the snapshot the live figures were computed from. Cite as: CVE Security Defender Scoreboard, cve-security.com/scoreboard.

## Path parameters

- `file` 'scoreboard.json' | 'kev_no_public_detection.csv' | 'kev_no_actionable_fix.csv' | 'ransomware_fixed_but_undetectable.csv' | 'kev_neither_detect_nor_fix.csv' | 'poc_public_no_fix.csv', required

## Response `200`

The report (application/json) or a one-column cve_id CSV (text/csv)

## Other responses

- `404`: Unknown file, body lists what is available
- `503`: Not computed yet, retry later (Retry-After header)

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)