VUvulnerability-lookup
stats

GET /stats/kev

Changed on

Returns known-exploited inclusion for a source. Without granularity, the membership counts: how many of its records appear in each catalogue. With granularity=year or month, how many each catalogue listed per period, bucketed on the date the catalogue listed the record rather than on the record's publication date.

Request

  • Base URL
    /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/stats/kev
  • Auth
    API key in header X-API-KEY

Query parameters

sourcestring

The source to report on, e.g. cvelistv5 or euvd.

granularity'' | 'year' | 'month'

Omit for the known-exploited membership counts. With year or month, the number of records each catalogue listed per period instead.

periodstring

With granularity=month, the year whose months are returned (YYYY). Defaults to the current year. Refused otherwise, where the answer already carries every year.

Response

Success.

availableboolean

False when this source does not maintain a known-exploited index.

basisstring

What the counts are counted on: membership without granularity (set membership, carrying no date), listed_at with it (the date each catalogue listed the record: first_seen_at, then recorded_at, then status_updated_at -- never the record's publication date).

catalogsobject

Catalogue short name -> record count, or -> {period: count} with a granularity. These overlap: a record listed by two catalogues is counted by both, so they sum to more than exploited (or than totals).

computed_atstring

When the period buckets were last prepared.

exploitedinteger

Records appearing in at least one known-exploited catalogue. Null in the period form, where totals carries the series.

granularitystring

year or month with a period series, null without one.

periodstring

With granularity=month, the year broken into months.

rationumber

exploited / total, or null when the source is empty.

scope_catalogsobject

The catalogue short names the figure was measured over, present when scoped. Its own field because catalogs carries the per-catalogue series in the period form.

scopedboolean

True when the figure is restricted to the catalogues configured for this source (STATS_KEV_CATALOGS): exploited is then the union of exactly the catalogues listed in catalogs. False when it covers every catalogue the instance knows.

sourcestring

The source reported on.

totalinteger

The denominator: currently-published records, or every record held. Null in the period form.

total_basisstring

Which population total counts: state_published for a source whose lifecycle index says what is published now, date_published for one that only records when a vulnerability was published, held for one that does neither. Null in the period form.

totalsobject

Period -> distinct records that became known exploited in it, each counted once in the period its first catalogue listed it. Only with a granularity.

unattributedinteger

Exploited records held under a catalogue this instance cannot name, counted the same way when scoped: a record a scope leaves out is not unattributed, but one in no known catalogue still is. Non-zero means the local catalogue reference data is absent or stale. Null in the period form, where unattributed_periods carries the series.

unattributed_periodsobject

Period -> exploited records held under a catalogue this instance cannot name. Only with a granularity; the membership form reports the count in unattributed.

Changes