---
title: "List CVEs"
method: GET
path: "/v3/cves/list"
tags: ["CVE"]
---

# List CVEs

`GET /v3/cves/list`

Return CVE records tracked by GreyNoise, ordered by publication date,
last-update date, or CVSS score. Default cap is 100 records, configurable
up to 1000 via the `limit` query parameter.

This endpoint requires the `feature-search-cves-bulk` entitlement.
Response payload is shaped according to the caller's CVE Insights tier
(minimal, basic, or advanced).

## Query parameters

- `sort` 'published' | 'updated' | 'cvss'
- `order` 'desc' | 'asc'
- `exploitable_only` boolean
- `limit` integer

## Response `200`

OK - request successful.

- object
  - `cves` union[]
    - union
      - CVEAdvancedResponse
        - `id` string — The CVE identifier.
        - `details` CVEDetails
          - `vulnerability_name` string — The name of the vulnerability.
          - `vulnerability_description` string — Description of the vulnerability.
          - `cve_cvss_score` number — The CVSS score of the CVE.
          - `product` string — The product affected by the vulnerability.
          - `vendor` string — The vendor of the affected product.
          - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.
        - `timeline` CVETimeline
          - `cve_published_date` string, date — The date the CVE was published.
          - `cve_last_updated_date` string, date — The date the CVE was last updated.
          - `first_known_published_date` string, date — The first known published date of the CVE.
          - `cisa_kev_date_added` string, date — The date the CVE was added to the CISA KEV list.
        - `exploitation_details` CVEExploitationDetails
          - `attack_vector` string — The attack vector for the CVE.
          - `exploit_found` boolean — Whether an exploit has been found for this CVE.
          - `exploitation_registered_in_kev` boolean — Whether the exploitation is registered in KEV.
          - `epss_score` number — The EPSS score for the CVE.
        - `exploitation_stats` CVEExploitationStats
          - `number_of_available_exploits` integer — The number of available exploits for the CVE.
          - `number_of_threat_actors_exploiting_vulnerability` integer — The number of threat actors exploiting the vulnerability.
          - `number_of_botnets_exploiting_vulnerability` integer — The number of botnets exploiting the vulnerability.
        - `exploitation_activity` CVEExploitationActivity
          - `activity_seen` boolean — Whether exploitation activity has been observed.
          - `benign_ip_count_1d` integer — The count of benign IPs in the last day.
          - `benign_ip_count_10d` integer — The count of benign IPs in the last 10 days.
          - `benign_ip_count_30d` integer — The count of benign IPs in the last 30 days.
          - `threat_ip_count_1d` integer — The count of threat IPs in the last day.
          - `threat_ip_count_10d` integer — The count of threat IPs in the last 10 days.
          - `threat_ip_count_30d` integer — The count of threat IPs in the last 30 days.
      - CVEBasicResponse
        - `id` string — The CVE identifier.
        - `details` CVEDetails
          - `vulnerability_name` string — The name of the vulnerability.
          - `vulnerability_description` string — Description of the vulnerability.
          - `cve_cvss_score` number — The CVSS score of the CVE.
          - `product` string — The product affected by the vulnerability.
          - `vendor` string — The vendor of the affected product.
          - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.
        - `timeline` CVETimeline
          - `cve_published_date` string, date — The date the CVE was published.
          - `cve_last_updated_date` string, date — The date the CVE was last updated.
          - `first_known_published_date` string, date — The first known published date of the CVE.
          - `cisa_kev_date_added` string, date — The date the CVE was added to the CISA KEV list.
        - `exploitation_details` CVEExploitationDetails
          - `attack_vector` string — The attack vector for the CVE.
          - `exploit_found` boolean — Whether an exploit has been found for this CVE.
          - `exploitation_registered_in_kev` boolean — Whether the exploitation is registered in KEV.
          - `epss_score` number — The EPSS score for the CVE.
      - CVEMinimalResponse
        - `id` string — The CVE identifier.
        - `details` CVEDetails
          - `vulnerability_name` string — The name of the vulnerability.
          - `vulnerability_description` string — Description of the vulnerability.
          - `cve_cvss_score` number — The CVSS score of the CVE.
          - `product` string — The product affected by the vulnerability.
          - `vendor` string — The vendor of the affected product.
          - `published_to_nist_nvd` boolean — Whether the CVE is published to the NIST National Vulnerability Database.
  - `generated_at` string, date-time — Timestamp when the response was produced.

## Other responses

- `400` — Bad request — unknown sort/order, bad limit, or invalid exploitable_only.
- `403` — Forbidden — caller lacks the bulk CVE search entitlement.
- `500` — Unexpected error

---

[API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)