---
title: "Indicators of every CVE exploited in the last 7 days"
method: GET
path: "/edl/exploited-cves"
tags: ["blocklist"]
---

# Indicators of every CVE exploited in the last 7 days

`GET /edl/exploited-cves`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/edl/exploited-cves`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

## Query parameters

- `type` string
- `format` string

## Response `200`

The list (text/plain, text/csv or application/json). Enterprise: rebuilt hourly; Pro: the day's snapshot (`X-Exploited-Snapshot`)

## Other responses

- `400`: `invalid_type` or `invalid_format`
- `401`: Unauthorized
- `403`: `plan_required`: Pro and above
- `429`: Rate limit exceeded
- `503`: `not_ready`: the list has not been built yet

## Changes

- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/edl/exploited-cves/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)