No API key required. Rate-limited at 60 requests per minute per IP via our WAF. Need higher throughput? Get in touch.
GET/api/v1/public/cves
The main feed — paginated JSON list, newest first. Params: limit (default 50), offset, search, vendor, severity, min_cvss, kev_only, year, sort (published | epss | severity | cvss_v3_score). severity filters on NVD's CVSS v3 label by default; pass severity_basis=eg to filter on the EchelonGraph severity instead — that is the basis the /pulse counts use, and it is the only way to reach the ~72,000 CVEs NVD never rated under v3. min_cvss matches the highest CVSS we hold (v3.1, v4.0 or v2.0). Rate limited per IP; see Limits below.
curl "https://app.echelongraph.io/api/v1/public/cves?severity=HIGH&severity_basis=eg&min_cvss=7&limit=20"
GET/api/v1/public/cves/summary
Overall counts and the live NVD poller's health snapshot, updated continuously. Severity buckets (critical/high/medium/low/unscored) use the EchelonGraph severity — the band we publish — and always sum to total. NVD's own CVSS v3 classification is returned alongside as nvd_critical/nvd_high/nvd_medium/nvd_low/nvd_none, so you can compare the two bases.
curl https://app.echelongraph.io/api/v1/public/cves/summary
GET/api/v1/public/cves/{id}
Single CVE record — the merged view: NVD CVSS, EchelonGraph synthesised score, KEV/EPSS signals, GHSA references, vendor advisory cross-links. For the ~72,000 pre-2016 CVEs that NVD only ever rated under CVSS v2, cvss_v3_score is 0 and the real rating is in cvss_v2_score / cvss_v2_severity / cvss_v2_vector — v2 has three bands only (LOW 0.0-3.9 / MEDIUM 4.0-6.9 / HIGH 7.0-10.0, no CRITICAL) and is NOT comparable to a v3 score. exploit_poc_available is derived from verified exploit records (Exploit-DB, Metasploit, GitHub PoC, Nuclei), not self-reported.
curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228
GET/api/v1/public/cves/{id}/related
Three categories of related CVEs (same_product / same_vendor / same_cwe), 10 each, ranked by EchelonGraph score. Powers the sidebar on every /pulse/{id} page.
curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228/related
GET/api/v1/public/cves/{id}/references
Per-reference enrichment for one CVE — vendor advisory cross-walks, patch URLs, exploit POC indicators where surfaced.
curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228/references
GET/api/v1/public/cves/trends
Weekly + monthly volume + week-over-week delta + severity distribution. Backs the dashboard cards on /pulse.
curl https://app.echelongraph.io/api/v1/public/cves/trends
GET/api/v1/public/cves/export.ndjson
Streaming NDJSON bulk export — one CVE per line. Filters: year, severity, kev_only, min_cvss. min_cvss matches the HIGHEST CVSS we hold for a CVE (v3.1, v4.0 or v2.0), so a v2-only 10.0 is included where a v3-only filter would have missed it. Hard cap 50,000 rows per call (iterate via the year param for the full dataset).
curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2024&severity=CRITICAL&kev_only=true" | jq -c .
GET/api/v1/public/vendor-advisories
Vendor-disclosed security advisories (Microsoft MSRC, Red Hat RHSA, GitHub GHSA, Cisco PSIRT, AWS, GCP, GitLab). Many appear here before NVD assigns a CVE-ID.
curl https://app.echelongraph.io/api/v1/public/vendor-advisories?has_cve=true&limit=50
GET/api/v1/public/vendor-advisories/{vendor}/{advisory_id}
Single vendor-advisory detail — title, description, CVSS, affected products, remediation, references, linked CVE IDs.
curl https://app.echelongraph.io/api/v1/public/vendor-advisories/github/GHSA-99gv-2m7h-3hh9
Bulk NDJSON Export
For researchers + security teams who want offline analysis. The export streams one CVE per line as JSON (NDJSON / JSON Lines), so you can pipe it through jq -c . or process incrementally without buffering the whole dataset.
# All KEV-listed CVEs published in 2024
curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2024&kev_only=true" \
| jq -c '{cve_id, severity, echelongraph_score, kev_added: .kev_added_date}'
# Full 2023 CRITICAL dataset
curl "https://app.echelongraph.io/api/v1/public/cves/export.ndjson?year=2023&severity=CRITICAL" \
> cves-2023-critical.ndjsonHard cap: 50,000 rows per call. Iterate via the year param for the full dataset. The endpoint streams from a DB cursor, so memory pressure stays flat regardless of result size.
Want to be notified when critical CVEs hit?
Subscribe to real-time or digest alerts covering NVD + vendor-disclosed advisories.
Subscribe via /pulse →