Threat intelligence API / Reference / Vulnerabilities

Vulnerabilities endpoints

CVEs joined with EPSS, KEV and exploitation reporting.

GET /vulnerabilities · GET /vulnerabilities/stats · GET /vulnerabilities/{cve_id}

GET /vulnerabilities

List CVEs · 1 credit per call

Get CVE/vulnerability feed.

Query parameters

  • days: CVEs from last N days (default: 30, max: 730). Ignored if published_after is set.
  • published_after / published_before: ISO-8601 date bounds (absolute range; alternative to days).
  • severity: Filter by severity (CRITICAL, HIGH, MEDIUM, LOW) - comma-separated
  • kev_only: Only CISA KEV entries (default: false)
  • has_exploit: Only CVEs with known exploits (default: false)
  • vendor: Filter by affected vendor (matches affected_vendors)
  • product: Filter by affected product (matches affected_products)
  • page: Page number (default: 1)
  • limit: Results per page (default: 50, max: 100)

Returns paginated CVE list with CVSS scores and exploit status.

Parameters

NameInTypeRequiredMeaning
daysqueryinteger
severityquerystring
kev_onlyqueryboolean
has_exploitqueryboolean
vendorquerystring
productquerystring
published_afterquerystring
published_beforequerystring
pagequeryinteger
limitqueryinteger

Response 200 · CveListResponse

FieldTypeMeaning
cves *array of CveListItem
total *integer
page *integer
limit *integer
pages *integer
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/vulnerabilities"

GET /vulnerabilities/stats

CVE counts + severity breakdown · 1 credit per call

Get vulnerability statistics.

Returns total CVEs, KEV count, severity breakdown, and recent trends.

Response 200 · CveStatsResponse

FieldTypeMeaning
total_cves *integer
kev_count *integer
with_exploits *integer
last_7_days *integer
severity_breakdown *CveSeverityBreakdown
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/vulnerabilities/stats"

GET /vulnerabilities/{cve_id}

CVE detail · 1 credit per call

Get detailed CVE information.

Path parameters

  • cve_id: CVE identifier (e.g., CVE-2024-1234)

Returns full CVE details including CVSS, affected products, KEV status, and exploit info.

Parameters

NameInTypeRequiredMeaning
cve_idpathstringyes

Response 200 · CveDetail

FieldTypeMeaning
cve_id *string
descriptionstring or null
cvss_v3_scorenumber or null
cvss_v3_severitystring or null
affected_vendorsarray or null
affected_productsarray or null
cpe_configurationsarray or null
in_kevboolean or null
has_exploitboolean or null
epss_scorenumber or null
epss_percentilenumber or null
published_datestring or null
last_modifiedstring or null
idinteger or null
cvss_v3_vectorstring or null
cwe_idsarray or null
reference_urlsarray or null
kev_added_datestring or null
kev_due_datestring or null
ransomware_usestring or null
exploit_countinteger or null
first_exploit_datestring or null
fetched_atstring or null
curl -H "X-API-Key: $TC_KEY" \
  "https://threatcluster.io/api/public/v1/vulnerabilities/{cve_id}"