VUvulnerability-lookup
euvd-stats

Report known-exploited inclusion, in total or per period

Changed on
get/euvd/stats/kev

Request

  • Base URL
    /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/euvd/stats/kev
  • Auth
    API key in header X-API-KEY

Query parameters

granularity'' | 'year' | 'month'

Omit for the known-exploited membership counts. With year or month, the number of records each catalogue listed per period instead.

periodstring

With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused otherwise, where the answer already carries every year.

Response

Success.

availableboolean

False before the KEV sync has built the exploited index.

basisstring

What the counts are counted on: membership without granularity (set membership, carrying no date), listed_at with it (the date each catalogue listed the record, never the record's publication date).

catalogsobject

Catalogue short name -> record count, or -> {period: count} with a granularity. These overlap: a record listed by two catalogues is counted by both, so they sum to more than exploited (or than totals).

computed_atstring

When the period buckets were last prepared.

exploitedinteger

Records whose CVE appears in at least one of the catalogues in catalogs (a union, not their sum). Null in the period form, where totals carries the series.

granularitystring

year or month with a period series, null without one.

periodstring

With granularity=month, the year broken into months.

rationumber

exploited / total, or null when the catalogue is empty.

scope_catalogsobject

The catalogue short names the figure was measured over, present when scoped. Its own field because catalogs carries the per-catalogue series in the period form.

scopedboolean

True when the figure is restricted to the catalogues configured for this source (STATS_KEV_CATALOGS): exploited is then the union of exactly the catalogues listed in catalogs. False when it covers every catalogue the instance knows.

totalinteger

The denominator: records in the catalogue, published where that is known. Null in the period form.

total_basisstring

Which population total counts: state_published for a source whose lifecycle index says what is published now, date_published for one that only records when a vulnerability was published, held for one that does neither. Null in the period form.

totalsobject

Period -> distinct records that became known exploited in it, each counted once in the period its first catalogue listed it. Only with a granularity.

unattributedinteger

Exploited records held under a catalogue this instance cannot name, counted the same way when scoped: a record a scope leaves out is not unattributed, but one in no known catalogue still is. Non-zero means the local GCVE reference data is absent or stale. Null in the period form, where unattributed_periods carries the series.

unattributed_periodsobject

Period -> exploited records held under a catalogue this instance cannot name. Only with a granularity; the membership form reports the count in unattributed.

Changes