---
title: "Actively exploited CVEs, ranked patch-first."
method: GET
path: "/api/vulnerabilities/exploited"
tags: ["Layer 1 — open, no key"]
---

# Actively exploited CVEs, ranked patch-first.

`GET /api/vulnerabilities/exploited`

## Request

- Base URL: `https://outage.me`
- URL: `https://outage.me/api/vulnerabilities/exploited`
- Auth: none declared

CISA KEV entries ranked by CVSS × EPSS exploitation probability × known ransomware use, with CISA due date and patch status. Open upstreams only (KEV public domain, FIRST EPSS, NIST NVD). Deterministic: no model in the loop.

Returns: vulnerabilities[] {cve, title, score, tier, factors, due_date, patched, url}

## Response `200`

OK

- object
  - `as_of` string, date, required: Snapshot date (UTC).
  - `source` string, required: Where the facts come from.
  - `license` string, required: Terms of reuse (attribution).
  - `count` integer, required: Rows in this response.
  - `vulnerabilities` object[], required
    - `cve` string
    - `title` string
    - `score` integer
    - `tier` 'critical' | 'high' | 'medium' | 'low'
    - `factors` string[]
    - `due_date` string, nullable
    - `patched` boolean, nullable
    - `url` string, nullable

---

[API](https://skmtc.dev/outage/apis/outage-me-agent-api.md) · [All operations](https://skmtc.dev/outage/apis/outage-me-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/outage/apis/outage-me-agent-api/revisions/34d6abde73dd?raw)