---
title: "Indicators tagged with one CVE"
method: GET
path: "/edl/cve/{id}"
tags: ["blocklist"]
---

# Indicators tagged with one CVE

`GET /edl/cve/{id}`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/edl/cve/{id}`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

## Path parameters

- `id` string, required

## Query parameters

- `type` string
- `format` string

## Response `200`

The list (text/plain, text/csv or application/json), from the CVE's indicator index, whether or not the CVE is in the exploited set

## Other responses

- `400`: `invalid_cve_id`, `invalid_type` or `invalid_format`
- `401`: Unauthorized
- `403`: `plan_required`: Pro and above
- `429`: Rate limit exceeded
- `503`: `not_ready`: the indicator index has not been built yet

## Changes

- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/edl/cve/:id/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)