---
title: "CVEs exploited in the last N days"
method: GET
path: "/cve/exploited"
tags: ["cve"]
---

# CVEs exploited in the last N days

`GET /cve/exploited`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/cve/exploited`
- Auth: one of:
  - none
  - API key in header `X-API-KEY`
  - HTTP bearer

Attested exploitation only (`confirmed`: CISA KEV, CISA-ADP SSVC active
or two independent sources; `reported`: one source), first seen, last
seen or added to KEV inside the window; Rejected CVEs excluded. CVEs
first attested inside the window come before those only seen again in
it; in each group confirmed first, then the most recent evidence.
`iocCount24h` / `iocCount7d` are `null` when the CVE→IOC index is
missing (unknown, never 0);
`kevLeadDays` only when an independent source attested exploitation
before CISA KEV listed it. `titleSource` names OpenCVE or MSRC when the
line's title is theirs, and `attribution` carries MITRE's CVE designation
and licence, the NVD notice, and the clause of every restricted source a
line draws on (also the header
`Link: <https://api.ismalicious.com/cve/attribution>; rel="license"`).
Costs one request with an API key.

## Query parameters

- `days` integer
- `limit` integer

## Response `200`

`{days, generatedAt, count, total, cves[], attribution}`: `count` lines listed, `total` in the window

- ExploitedCvesResponse
  - `attribution` ListAttribution, required: The `attribution` block of a list envelope: the notices once, and the restricted sources any item uses.
    - `manifest` string, required
    - `notices` RenderedNotice[], required
      - `id` string, required: `cve-program` or `nvd`.
      - `licence` string, nullable: The licence text that must travel with the notice (the CVE grant).
      - `text` string, required
      - `url` string, required
    - `restricted` RestrictedUse[], required
      - `fields` string[], required: Keys of the answer that carry its data; empty when it only contributed to the record.
      - `id` string, required
      - `name` string, required
      - `note` string, required
      - `terms` string, required: The clause, quoted from the publisher's terms.
  - `count` integer, required: Lines in `cves`: at most the request's `limit`.
  - `cves` ExploitedCve[], required
    - `commonName` string, nullable
    - `cveId` string, required
    - `cvssScore` number, double, nullable
    - `cvssVersion` string, nullable: `4.0`, `3.1`, `3.0`, `2.0`.
    - `epssScore` number, double, nullable
    - `exploitationFirstSeenAt` string, date-time, nullable
    - `exploitationLastSeenAt` string, date-time, nullable
    - `exploitationSources` string[], required: Display names; restrictive licences are never named.
    - `exploitationStatus` 'confirmed' | 'reported' | 'poc' | 'none', required: `confirmed`: CISA KEV, CISA-ADP SSVC « active », or two independent sources. `reported`: exactly one source. `poc`: public proof of concept only. OpenCVE's SSVC mirrors CISA-ADP (Vulnrichment) and never counts as a second source.
    - `hasNucleiTemplate` boolean, required
    - `hasPoc` boolean, required
    - `iocCount24h` integer, nullable: `None` when the CVE→IOC index is missing — never 0 for unknown.
    - `iocCount7d` integer, nullable
    - `isKev` boolean, required
    - `kevDateAdded` string, date-time, nullable
    - `kevLeadDays` integer, nullable: Days between the first attested exploitation and the KEV addition.
    - `malwareFamilies` string[], required
    - `patchAvailable` boolean, nullable
    - `pocCount` integer, required
    - `publishedAt` string, date-time, nullable
    - `severity` string, nullable
    - `title` string, nullable
    - `titleSource` string, nullable: Who wrote `title` when its publisher's terms forbid redistributing it: `opencve` or `msrc` (the clause is in `attribution.restricted`); `null` when there is no title.
  - `days` integer, required
  - `generatedAt` string, date-time, required
  - `total` integer, required: Every CVE the window holds, before the `limit`; `count` is at most it.

## Other responses

- `400`: Invalid window
- `429`: Rate limit exceeded
- `500`: Database error

## Changes

- **2026-11-04** `b6f45e6169a7`: 1 info
  - added the required property `total` to the response with the `200` status
- **2026-11-01** `e802f56e895a`: 2 info
  - added the optional property `cves/items/titleSource` to the response with the `200` status
  - added the required property `attribution` to the response with the `200` status
- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/exploited/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)