VUvulnerability-lookup
stats

GET /stats/time_to_exploit

Changed on

Returns the publication-to-exploitation summary of a source, over the whole source, over the records it published in one year, or per publication year with granularity=year.

Request

  • Base URL
    /api (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/stats/time_to_exploit
  • Auth
    API key in header X-API-KEY

Query parameters

sourcestring

The source to report on, e.g. cvelistv5 or euvd.

periodstring

Restrict the figure to one publication year (YYYY). Omit for the whole source.

granularity'' | 'year'

year for every publication year at once, each with its own summary and count. Not combined with period.

Response

Success.

availableboolean

False when the cross-store scan has never run.

before_publication_mean_daysnumber

Mean of the intervals of the records listed before publication (a negative number); absent when there are none.

computed_atstring

When the snapshot was taken.

countinteger

Records the figure rests on -- those ever exploited. Reported for every period, because one publication year's exploited records can be a dozen.

cves_exploitedinteger

Distinct CVEs those entries named -- the denominator of the two unmatched counts.

entries_scannedinteger

Known-exploited catalogue entries the scan read.

excluded_not_publishedinteger

Exploited records left out because they are not currently published: withdrawn or reserved. Zero for a source that keeps no lifecycle index, where nothing is narrowed.

exploited_before_publicationinteger

Of count, how many were listed before the record was published.

granularitystring

year with the per-year series.

max_daysnumber

Longest observed interval.

mean_daysnumber

Mean days from publication to first listing, one decimal.

median_daysnumber

Median days, reported alongside the mean.

min_daysnumber

Shortest observed interval.

p90_daysnumber

90th percentile, nearest rank.

periodstring

The publication year the summary covers, or null for the whole source.

records_outside_year_rangeinteger

With a granularity, records whose publication year falls outside the years the series is drawn over: years sums to count minus this.

scope_catalogsobject

The catalogue short names the figure was measured over, present when scoped. Its own field because catalogs carries the per-catalogue series in the period form.

scopedboolean

True when the figure was measured over the catalogues configured for this source (STATS_KEV_CATALOGS), which scope_catalogs then names. False when it covers every catalogue the instance knows.

sourcestring

The source reported on.

unmatched_no_publication_dateinteger

Exploited records carrying no publication date, so they could not be dated.

unmatched_no_recordinteger

Exploited CVEs this source holds no record for, so they could not be dated. Reported rather than dropped: the figures above are a mean over what remains.

yearsobject

With granularity=year: publication year -> the same summary (count, mean_days, median_days, p90_days, min_days, max_days, exploited_before_publication, before_publication_mean_days), over every year the source spans; a year whose records were never exploited is {count: 0}.

Changes