Publication change stream (keyed, cursorable)
Every event this site published, in the order WE published it: first_published (CVE newly tracked), kev_added, detection_added (first ET/Snort signature), remediation_added (first vendor fix). Walk forward with cursor from each response's next_cursor; since is first-call convenience with strictly-after semantics. published_at is this site's publish time (rows before 2026-07-26 are day-granular; a bare-date since therefore excludes that day's legacy day-bucket rows); source_date is the origin date (NVD/CISA/detection) for context. Events for withdrawn CVE identifiers are omitted. Keyed: this stream is an integration surface, so it uses the same free account key as /api/cve/{id} and counts against the daily limit. The same stream without a key: the MCP get_updates tool (AI agents) and the Atom feeds /feeds/updates.xml + /feeds/updates/{new-cves|kev|detection|remediation}.xml (newest-100 window for feed readers). Per-IP rate limited (30/min).
Request
- Base URL: https://cve-security.com
- URL: https://cve-security.com/api/updates
- Auth: one of:
- HTTP bearer
- API key in header X-API-Key
Query parameters
Opaque position from a previous response's next_cursor. Mutually exclusive with since.
YYYY-MM-DD or YYYY-MM-DDTHH:MM:SSZ (UTC), strictly-after
Response
{ as_of, events[], next_cursor, has_more }, each event: id, cve_id, change_type, published_at, source_date, detail, severity, kev_listed, url. as_of is the stream's newest publish stamp; hold next_cursor and re-poll to tail the stream.
Changes
No recorded changes to this operation across all 1 revision of this API.