JSON API

Evidence and timing vocabulary

Source reported means the named source asserted the fact. Corroborating observation marks an independent external observation. Tracker computed and Tracker inference are Cybersecurity Tracker outputs, not statements by the named source.

Source last published is when the source published the material. Source last updated is when the source last changed the material. Tracker last fetched is when Cybersecurity Tracker retrieved it. Tracker last fetched never substitutes for Source last published or Source last updated.

In /data/meta.json, last_updated is Tracker data as of. A per-artifact generated_at is This dataset exported at, which is when that dataset was written and is not the same measurement as the site wide Tracker data as of. Afetched_at value is Tracker last fetched. A field is Source last published only where its endpoint contract identifies the value as source-supplied.

Endpoints

Examples

Every data endpoint below is a plain HTTPS GET. The examples cover curl, Python with requests, and PowerShell. The one exception is the Model Context Protocol server, which is a POST; it has its own section below.

day=2026-09-12; pages=$(curl -s https://cybersecuritytracker.ai/data/index.json | jq -r --arg day "$day" '.day_pages[$day] // 1'); for page in $(seq 1 "$pages"); do if [ "$page" = 1 ]; then path="$day.json"; else path="$day/$page.json"; fi; curl -s "https://cybersecuritytracker.ai/data/days/$path"; done | jq -s '[.[].items[]] | .[:5] | map({title, url, category})'

import requests

base = "https://cybersecuritytracker.ai"
day = "2026-09-12"
index = requests.get(f"{base}/data/index.json", timeout=30).json()
items = []
for page in range(1, index.get("day_pages", {}).get(day, 1) + 1):
    path = f"{day}.json" if page == 1 else f"{day}/{page}.json"
    items.extend(requests.get(f"{base}/data/days/{path}", timeout=30).json()["items"])
for item in items[:5]:
    print(item["title"], "->", item["url"])

$base = "https://cybersecuritytracker.ai"
$day = "2026-09-12"
$index = Invoke-RestMethod "$base/data/index.json"
$pages = if ($index.day_pages.$day) { $index.day_pages.$day } else { 1 }
$items = 1..$pages | ForEach-Object {
  $path = if ($_ -eq 1) { "$day.json" } else { "$day/$_.json" }
  (Invoke-RestMethod "$base/data/days/$path").items
}
$items | Select-Object -First 5 title, url

for i in $(seq 0 $(($(curl -s https://cybersecuritytracker.ai/data/vulns_index/manifest.json | jq '.shards')-1))); do curl -s https://cybersecuritytracker.ai/data/vulns_index/$i.json; done | jq -s '[.[].vulns[] | select(.cisa_kev)] | length'

import requests

manifest = requests.get("https://cybersecuritytracker.ai/data/vulns_index/manifest.json", timeout=30).json()
vulns = []
for i in range(manifest["shards"]):
    vulns += requests.get(f"https://cybersecuritytracker.ai/data/vulns_index/{i}.json", timeout=30).json()["vulns"]
movers = [v for v in vulns if v.get("mover_reasons")]
for v in movers[:5]:
    print(v["cve_id"], v["cvss_score"], v["mover_reasons"])

$manifest = Invoke-RestMethod "https://cybersecuritytracker.ai/data/vulns_index/manifest.json"
$vulns = 0..($manifest.shards - 1) | ForEach-Object { (Invoke-RestMethod "https://cybersecuritytracker.ai/data/vulns_index/$_.json").vulns }
$vulns | Where-Object { $_.cisa_kev } | Select-Object -First 5 cve_id, vendor, cvss_score

curl -s https://cybersecuritytracker.ai/data/breaches_index.json | jq '.breaches[] | select(.kind == "confirmed") | .org_name' | head

import requests

breaches = requests.get("https://cybersecuritytracker.ai/data/breaches_index.json", timeout=30).json()["breaches"]
claims = [b for b in breaches if b["kind"] == "claim"]
print(len(claims), "unverified claims")

$b = (Invoke-RestMethod "https://cybersecuritytracker.ai/data/breaches_index.json").breaches
$b | Group-Object kind | Select-Object Name, Count

base=https://cybersecuritytracker.ai/data/vendor_patches
shards=$(curl -s "$base/manifest.json" | jq -r .shards)
for n in $(seq 0 $((shards-1))); do curl -s "$base/$n.json"; done

import requests

base = "https://cybersecuritytracker.ai/data/vendor_patches"
manifest = requests.get(f"{base}/manifest.json", timeout=30).json()
months = []
for shard in range(manifest["shards"]):
    payload = requests.get(f"{base}/{shard}.json", timeout=30).json()
    for fragment in payload["months"]:
        if months and months[-1]["month"] == fragment["month"]:
            months[-1]["patches"].extend(fragment["patches"])
        else:
            months.append({"month": fragment["month"], "patches": list(fragment["patches"])})
rows = sum(len(month["patches"]) for month in months)
if rows != manifest["count"]:
    raise RuntimeError(f"incomplete vendor patches: {rows}/{manifest['count']}")
data = {key: manifest[key] for key in
        ("generated_at", "attribution", "vendor_totals", "coverage")}
data["months"] = months
print(rows, "vendor patches across", len(data["months"]), "months")

$base = "https://cybersecuritytracker.ai/data/vendor_patches"
$manifest = Invoke-RestMethod "$base/manifest.json"
$rows = for ($n = 0; $n -lt $manifest.shards; $n++) {
  (Invoke-RestMethod "$base/$n.json").months.patches
}
if ($rows.Count -ne $manifest.count) { throw "Incomplete vendor patches" }
$rows | Select-Object -First 5 vendor, advisory_id, cve_id

curl -s https://cybersecuritytracker.ai/data/stats.json | jq '.ransomware_by_group[:5]'

import requests

stats = requests.get("https://cybersecuritytracker.ai/data/stats.json", timeout=30).json()
for row in stats["ransomware_by_group"][:5]:
    print(row["month"], row["group_name"], row["n"])

(Invoke-RestMethod "https://cybersecuritytracker.ai/data/stats.json").ransomware_by_group |
  Select-Object -First 5 month, group_name, n

curl -s https://cybersecuritytracker.ai/data/meta.json | jq '.vendor_feeds[:5]'

import requests

meta = requests.get("https://cybersecuritytracker.ai/data/meta.json", timeout=30).json()
slugs = [v["slug"] for v in meta["vendor_feeds"]]
print(len(slugs), "vendor feeds, e.g.", slugs[:3])

$meta = Invoke-RestMethod "https://cybersecuritytracker.ai/data/meta.json"
$meta.vendor_feeds | Select-Object -First 5 slug, name

curl -s https://cybersecuritytracker.ai/rss/vendor/fortinet.xml | head -20
curl -s "https://cybersecuritytracker.ai/rss/custom?cats=vulnerabilities&vendors=microsoft,cisco"

import feedparser  # pip install feedparser

feed = feedparser.parse("https://cybersecuritytracker.ai/rss/custom?vendors=microsoft,cisco")
for entry in feed.entries[:5]:
    print(entry.title)

$rss = [xml](Invoke-WebRequest "https://cybersecuritytracker.ai/rss/vendor/fortinet.xml").Content
$rss.rss.channel.item | Select-Object -First 5 title

Custom RSS

One dynamic endpoint builds a merged feed from any combination of category and vendor slugs:

GET /rss/custom?cats=vulnerabilities,ransomware&vendors=microsoft,cisco

Both parameters are optional but at least one is required. Unknown slugs are rejected with 400, request URLs over 4096 characters return 414, and the feed carries a 15-minute cache header. Build one interactively on the feeds page, which also exports your vendor selection as an Outline Processor Markup Language (OPML) file.

Model Context Protocol (MCP) server

The same public data is available through a Model Context Protocol server so an artificial intelligence assistant can query it directly. It is a stateless, read-only endpoint at /mcp speaking JSON-RPC 2.0 (protocol revision 2025-06-18): POST a JSON-RPC message with an Accept of application/json. It holds no session and no private data, and every tool reads only the public shards documented above, never an operator page.

Four tools are exposed: search_vulnerabilities (filter the priority-ranked corpus by text, CISA KEV membership, the Cybersecurity Tracker's exploitation status, and tier),get_vulnerability (one CVE's full record),list_recent_breaches, andget_corpus_insights. Results are truncated to a limit and report total_matched, so a capped list is never mistaken for a complete one.

# 1. Initialize the session
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

# 2. List the tools
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'

# 3. Call a tool: the top 5 CISA KEV CVEs by tracker priority
curl -s -X POST https://cybersecuritytracker.ai/mcp \
  -H 'content-type: application/json' -H 'accept: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search_vulnerabilities","arguments":{"cisa_kev_only":true,"limit":5}}}'

Fair use

There are no keys and no hard rate limits on the data shards. Be a good neighbor: honor the cache headers, keep sustained polling at or under one request per second, and poll no faster than the thing you are polling is cached. The data shards cache for5 minutes, the ready-made feeds for5 minutes, and a feed you build yourself for 15 minutes. The pipeline publishes on a schedule, so faster polling only re-reads identical bytes. If you need bulk history, fetch the monthly shards once rather than iterating the day shards.

Attribution

Known downstream consumer: evulnable.com uses Cybersecurity Tracker data for fixed versions and vendor actions.

Ransomware leak-site data is an Unverified claim sourced fromRansomLook and is licensed CC BY 4.0: if you re-expose breach or actor data from this API, keep that attribution. Source reported vulnerability facts come from CISA Known Exploited Vulnerabilities (KEV), the National Vulnerability Database (NVD), the Exploit Prediction Scoring System (EPSS) by FIRST, and vendor advisories. This product uses data from the NVD API but is not endorsed or certified by the NVD.

Per-CVE scanner_detections entries cover only factual Greenbone OpenVAS Community Feed VT mappings and ProjectDiscovery Nuclei template mappings. They are Tracker computed mappings and are preserved across failed source refreshes. Their presence supplies neither Tracker last fetched nor Source last published and does not prove current upstream presence. They are not scan results or detection guarantees. Greenbone data is ODbL 1.0; Nuclei templates are MIT. Keep the complete notices published on theattributions page when re-exposing them.

Adversary technique, group, and mitigation data comes from MITRE ATT&CK. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. The KEV-to-ATT&CK technique mappings and the ATT&CK-to-NIST 800-53 control mappings come from the MITRE Engenuity Center for Threat-Informed Defense (CTID), used under Apache 2.0; keep both attributions if you re-expose that data.

The complete public attribution register for every source whose data is re-exposed by these API artifacts is available at/attributions. The same source and licence and obligation set is embedded in /data/meta.json; downstream consumers must preserve the applicable credit, source link, licence link, non-commercial/share-alike condition, notice, or disclaimer recorded in each entry's obligation field.

Changelog

• 2026-08-26Attribution obligations are now machine-readable.Every /data/meta.json attribution entry additively carries the exact obligation text from the public attribution register alongside its existing source and licence fields.
• 2026-08-20Breaking change: retired /data/vendor_patches.json. The complete, unchanged corpus now ships as/data/vendor_patches/manifest.json plus ordered numbered shards under /data/vendor_patches/. Fetch shards0 through shards - 1, merge adjacent fragments of the same month, and verify the assembled row count equals manifest.count. Integrators with the old URL hardcoded must migrate to the manifest and shard paths.
• 2026-08-19Retired the monolithic vulns_index.json: the lean CVE table index now ships as /data/vulns_index/manifest.json(count, shards) plus its numbered shards under/data/vulns_index/, in the same priority order as before. The single file was heading for the same deploy-size cap the original vulns.json split (below) was written to dodge; sharding removes the ceiling rather than raising it, so index growth no longer risks a blocked deploy. Every field and every row is unchanged. The older /data/vulns_index.json path is gone; use the manifest and its shards.
• 2026-08-16/data/vulns_index.json gained two fields:epss_delta_7d, the change in a CVE's EPSS score against its retained prior reading, and epss_delta_7d_days, the measured age in days of that prior reading. The delta is a raw score fraction (for example 0.03), never a percent. The age is normally exactly seven and is genuinely older when ingest was interrupted, so read the movement against the age rather than against the field name. Both are absent, never 0, for a CVE with no retained prior reading. epss_delta_7d was previously documented here as a detail field found only in the per-CVE shards; it is now an index field, and that sentence has been corrected.
• 2026-07-30Retired the capped exploits.json: the Exploit-DB catalog now ships in full as /data/exploits/manifest.json plus entry shards under /data/exploits/. The old file carried only the most recent 20,000 of 46,636 entries; nothing is capped now, so the manifest's total and shown are equal, and it adds verified_total counted over the whole catalog. The /data/exploits.json path is gone, and the MCP search_exploits tool now searches every entry. The 2026-07-08 entry below predates this change and describes the now-retired file.
• 2026-07-17Added a Model Context Protocol (MCP) server at /mcp: a stateless, read-only JSON-RPC endpoint (protocol revision 2025-06-18) over this same public data, with tools for searching the priority-ranked vulnerability corpus, fetching one CVE's full record, listing recent breaches, and reading the corpus insights. It reads only the public shards and holds no session or private data. See the Model Context Protocol section above.
• 2026-07-17Added sigma_pack.json (a downloadable Sigma rule pack scoped to the tracker's technique index, with per-rule author attribution, back-links, and the embedded Detection Rule License 1.1 notice) and a static MISP feed under /data/misp/(manifest, one event per month of CISA Known Exploited Vulnerabilities additions, and hashes.csv; point a MISP instance's feed at the manifest URL). The MISP feed carries United States government public-domain facts plus the tracker's own priority tier only.
• 2026-07-17Added attack_navigator_layer_v4_5.json: a downloadable ATT&CK Navigator layer (format 4.5) whose technique heat counts distinct CVEs with an exploitation mapping in the CTID Known Exploited Vulnerabilities mappings snapshot. The file is absent until those mappings are ingested, and the sample basis ships in the layer's own metadata.
• 2026-07-16Retired the monolithic malicious_packages.json andbreaches.json: both now ship as a lean<name>_index.json plus per-record detail shards under /data/malicious_packages/ and/data/breaches/, fetched on demand, matching the vulnerabilities layout. The malicious-package bulk count (bulk_total) and the breach composition and reconciliation notes are unchanged. The older malicious_packages.json andbreaches.json paths are gone; use the indexes and their shards.
• 2026-07-13Retired the monolithic vulns.json: the corpus now ships as a lean vulns_index.json plus per-CVE detail shards under /data/vulns/, fetched on demand, so no single file approaches Cloudflare's 25 MiB per-file cap. The oldervulns.json path is gone; use the index and its shards. The two entries below predate this change and describe the now-retired file.
• 2026-07-08Added the Exploit-DB browse file /data/exploits.json and the /rss/exploits.xml feed (metadata and Exploit-DB links only). vulns.json gained anexploits array per CVE, and breaches.jsongained url_is_onion.
• 2026-07-06Added per-vendor RSS feeds, the vendors parameter on/rss/custom, and monthly rollups under/data/rollups/. vulns.json gainedcvss_version, epss_delta_7d,mentions_48h, mover_reasons, andmover_score. meta.json gainedvendor_feeds.
• 2026-07-06Removed the five-category cap on /rss/custom. Added per-persona feeds and why_it_matters on stories.
• 2026-07-01Initial public API: day and month shards, vulnerabilities, breaches, stats, calendar, and metadata.