Threat intelligence API / CVE API
CVE API
One record per CVE that joins the reference data, NVD, EPSS and CISA KEV, with the reporting: which vulnerabilities are being exploited this week, which actors are using them, which products and sectors are being hit. The triage question, answered from evidence instead of a score alone.
What a CVE record carries
- Reference data: CVSS, EPSS score and percentile, KEV listing and its due date, affected products.
- Exploitation evidence: the incidents in which the CVE appears, dated, with the sources, and the actors and malware named alongside it.
- Trend: mention counts over time, so a CVE that is suddenly in the news stands out from one that is merely severe.
The exploits hub and the vulnerability tracker show the same records on the site; the API is how a ticketing system, a scanner or a patch-priority script reads them.
Endpoints
| Call | Returns | Cost |
|---|---|---|
| GET /vulnerabilities | List CVEs | 1 |
| GET /vulnerabilities/stats | CVE counts + severity breakdown | 1 |
| GET /vulnerabilities/{cve_id} | CVE detail | 1 |
A single CVE is also an entity: GET /entities/cve/CVE-2026-1731 returns its overview, recent activity and the incidents that mention it.
One request
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/vulnerabilities?limit=25&days=7"
| Field | Type | Meaning |
|---|---|---|
| cves | array | |
| total | integer | |
| page | integer | |
| limit | integer | |
| pages | integer |
The rest of the API
Free threat intelligence API · Dark web API · IOC API · Threat actor API · Full reference
CVE API FAQ
Where does the exploitation status come from?
CISA KEV for the official listing, and ThreatCluster's own corpus for reporting of exploitation: an incident that names the CVE and describes attacks in the wild, with the sources attached.
Is EPSS included?
Yes, score and percentile, refreshed from FIRST.
Can I filter by vendor or product?
Yes, by the parameters listed in the reference for the vulnerabilities endpoint, and by searching the entity endpoints for the product name.
How is this different from NVD?
NVD tells you a CVE exists and how severe it is. This tells you whether anyone is using it, against whom, and since when, with the evidence.
What does a free key get?
The last seven days of vulnerability reporting, 25 rows a page. Researcher reads the full history.
Get a key and make a request
Free account, read-only key, 100 credits a day. Upgrade when you need the history.