CVE EPSS statistics
EPSS distribution, top CVEs by EPSS and a catalog-wide summary, computed from the CVE catalog in PostgreSQL. The body is assembled from raw query rows, so it is documented as a free-form object with these keys:
- distribution: [{"bucket": "0.7–0.8", "bucketStart": 0.7, "count": n}] — one row per 0.1-wide EPSS bucket, ascending. Honours the filters.
- top: up to limit rows, EPSS descending, honouring the filters: {"cveId", "epssScore", "epssPercent", "severity", "ssvcExploitation", "isKev", "isCertFr", "certfrAdvisoryId", "msrcExploited", "title", "description" (cut at 200 chars), "cvssScore", "nvdLink"}. severity, ssvcExploitation, certfrAdvisoryId, title, description and cvssScore may be null.
- summary: catalog-wide and unaffected by the filters: {"total", "withEpss", "avgEpss", "avgEpssPercent", "highRisk" (EPSS ≥ 0.7), "activeExploit", "pocExploit", "certFr", "msrcExploited"}.
Degrades instead of failing. A database error on any of the three queries is logged and that part comes back empty ([] for distribution/top, {} for summary) with a 200 — an integrator cannot tell an empty catalog from a failed query. There is no error response.
No authentication required. Not metered.
Query parameters
Number of rows in top. Default 20, clamped to 1–100.
Minimum EPSS probability, clamped to 0.0–1.0. Default 0.0 (no filter).
Restrict to CISA KEV entries. Active only when the value is exactly the string true; any other value is ignored.
Exact match on the SSVC exploitation status (active, poc, …). Passed through as a literal — an unknown value matches nothing.
Response
{"distribution": […], "top": […], "summary": {…}} — keys listed in the operation description; parts are empty rather than absent on a database error