Sign in
cve

CVE time series

CVE counts per time bucket, split by severity and exploitation signals, from the CVE catalog in PostgreSQL. A CVE is dated by lastModifiedAt, falling back to publishedAt, then createdAt. Free-form object with these keys:

  • series: [{"time": "2026-08-01T00:00:00Z", "critical", "high", "medium", "low", "kev", "activeExploit", "pocExploit", "certFr", "msrcExploited", "epssHigh"}], ascending, one row per bucket holding at least one CVE — empty buckets are not filled in.
  • summary: the same ten counters summed over the window.
  • total: critical + high + medium + low over the window.
  • catalogTotal: rows in the whole catalog, window-independent.
  • days: the effective window (0 under allTime); bucket: the effective bucket after the day fallback; allTime: echo of the input.

Degrades instead of failing. A database error yields series: [], zero counters and a 200; catalogTotal is 0 if its own count fails. There is no error response.

No authentication required. Not metered.

get/cve/stats/timeseries

Query parameters

bucketstring

Bucket size: day | week | month. Default day. Any other value silently falls back to day — a typo is not a 400.

daysinteger

Window length in days, ending now. Default 30; clamped to 1–365 for day, 1–730 for week, 1–1825 for month. Ignored when allTime is set.

allTimeboolean

true drops the window entirely; the response then reports days: 0.

Response

{"series": […], "summary": {…}, "total", "catalogTotal", "days", "bucket", "allTime"} — keys listed in the operation description; series is empty rather than absent on a database error

object required

Changes

Changed in 1 of the 15 revisions of this API.1