---
title: "CVE EPSS statistics"
method: GET
path: "/cve/stats/epss"
tags: ["cve"]
---

# CVE EPSS statistics

`GET /cve/stats/epss`

EPSS distribution, top CVEs by EPSS and a catalog-wide summary, computed
from the CVE catalog in PostgreSQL. The body is assembled from raw query
rows, so it is documented as a free-form object with these keys:

- `distribution`: `[{"bucket": "0.7–0.8", "bucketStart": 0.7, "count": n}]`
  — one row per 0.1-wide EPSS bucket, ascending. Honours the filters.
- `top`: up to `limit` rows, EPSS descending, honouring the filters:
  `{"cveId", "epssScore", "epssPercent", "severity", "ssvcExploitation",
  "isKev", "isCertFr", "certfrAdvisoryId", "msrcExploited", "title",
  "description" (cut at 200 chars), "cvssScore", "nvdLink"}`. `severity`,
  `ssvcExploitation`, `certfrAdvisoryId`, `title`, `description` and
  `cvssScore` may be `null`.
- `summary`: catalog-wide and **unaffected by the filters**: `{"total",
  "withEpss", "avgEpss", "avgEpssPercent", "highRisk" (EPSS ≥ 0.7),
  "activeExploit", "pocExploit", "certFr", "msrcExploited"}`.

**Degrades instead of failing.** A database error on any of the three
queries is logged and that part comes back empty (`[]` for
`distribution`/`top`, `{}` for `summary`) with a 200 — an integrator
cannot tell an empty catalog from a failed query. There is no error
response.

**No authentication required.** Not metered.

## Query parameters

- `limit` integer
- `minEpss` number, double
- `kev` string
- `exploit` string

## Response `200`

`{"distribution": […], "top": […], "summary": {…}}` — keys listed in the operation description; parts are empty rather than absent on a database error

- object

## Changes

- **2026-09-02** `b834b2860af7` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/stats/epss/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)