---
title: "CVE time series"
method: GET
path: "/cve/stats/timeseries"
tags: ["cve"]
---

# CVE time series

`GET /cve/stats/timeseries`

CVE counts per time bucket, split by severity and exploitation signals,
from the CVE catalog in PostgreSQL. A CVE is dated by `lastModifiedAt`,
falling back to `publishedAt`, then `createdAt`. Free-form object with
these keys:

- `series`: `[{"time": "2026-08-01T00:00:00Z", "critical", "high",
  "medium", "low", "kev", "activeExploit", "pocExploit", "certFr",
  "msrcExploited", "epssHigh"}]`, ascending, one row per bucket holding at
  least one CVE — empty buckets are not filled in.
- `summary`: the same ten counters summed over the window.
- `total`: `critical + high + medium + low` over the window.
- `catalogTotal`: rows in the whole catalog, window-independent.
- `days`: the effective window (`0` under `allTime`); `bucket`: the
  effective bucket after the `day` fallback; `allTime`: echo of the input.

**Degrades instead of failing.** A database error yields `series: []`,
zero counters and a 200; `catalogTotal` is `0` if its own count fails.
There is no error response.

**No authentication required.** Not metered.

## Query parameters

- `bucket` string
- `days` integer
- `allTime` boolean

## Response `200`

`{"series": […], "summary": {…}, "total", "catalogTotal", "days", "bucket", "allTime"}` — keys listed in the operation description; `series` is empty rather than absent on a database error

- object

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/stats/timeseries/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/58a5aec0e63b?raw)