---
title: "Field sightings: CVEs a sensor network recorded recently"
method: GET
path: "/api/sightings.json"
---

# Field sightings: CVEs a sensor network recorded recently

`GET /api/sightings.json`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/sightings.json`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

CVEs that Shadowserver honeypots (cited by VulnCheck KEV and published as daily lists by CIRCL Vulnerability-Lookup) or VulnCheck canary sensors recorded within the window, most sighting days first. Every row carries first and last sighting day, days sighted in the last 7 and 30, the sensors, KEV status, KEV Watch tier and the per-sensor detail. Presence per day, without volume; a sighting stays apart from the exploitation claims and from CISA KEV. Keyed; private-cacheable for 900s. Data attribution: VulnCheck KEV (community), CIRCL Vulnerability-Lookup.

## Query parameters

- `window` 7 | 30
- `kev` '0' | '1'
- `limit` integer

## Response `200`

{ generated, window_days, kev, shadowserver_as_of, count, attribution[], note, rows: [{cve_id, url, title, severity, cvss, epss, cisa_kev, kev_date, kev_watch_tier, detectable, sightings: {first, last, days_7d, days_30d, sensors[], detail}}] }

## Other responses

- `503`: Not built yet (builds nightly)

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)