Field sightings: CVEs a sensor network recorded recently

CVEs that Shadowserver honeypots (cited by VulnCheck KEV and published as daily lists by CIRCL Vulnerability-Lookup) or VulnCheck canary sensors recorded within the window, most sighting days first. Every row carries first and last sighting day, days sighted in the last 7 and 30, the sensors, KEV status, KEV Watch tier and the per-sensor detail. Presence per day, without volume; a sighting stays apart from the exploitation claims and from CISA KEV. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community), CIRCL Vulnerability-Lookup.

get/api/sightings.json

Request

  • Base URL: https://cve-security.com
  • URL: https://cve-security.com/api/sightings.json
  • Auth: one of:
    • HTTP bearer
    • API key in header X-API-Key

Query parameters

window7 | 30

Sighting window in days

kev'0' | '1'

Restrict to CVEs outside (0) or inside (1) CISA KEV; default both

limitinteger

Response

{ generated, window_days, kev, shadowserver_as_of, count, attribution[], note, rows: [{cve_id, url, title, severity, cvss, epss, cisa_kev, kev_date, kev_watch_tier, detectable, sightings: {first, last, days_7d, days_30d, sensors[], detail}}] }

Changes

No recorded changes to this operation across all 1 revision of this API.