{ "openapi": "3.1.0", "info": { "title": "Kevscope API API", "version": "1.0.0", "summary": "CVE priority API: for up to 20 CVEs per call, returns CISA KEV status (date added, federal due date, ransomware use), FIRST EPSS probability and percentile, CVSS from the CNA or CISA-ADP, CISA SSVC exploitation/automatable/impact and a public-rules verdict (act_now, high, medium, low) with reasons. Also recent KEV additions and a pre-KEV EPSS watchlist. REST + MCP server.", "description": "Send up to 20 CVE IDs and get a patch-priority verdict for each, with the evidence behind it: CISA KEV status and due date, ransomware use, FIRST EPSS, CVSS and CISA's SSVC exploitation call. For security teams, MSPs, scanners and AI agents. Free tier, no key; plans from $19/month.\n\nFree tier: Up to 20 CVEs per call; 10 calls a minute per IP on the free tier. Free tier: 200 calls a day per IP, no key. Paid keys from $19/month (see Get an API key). Sources are asked live and cached up to 1 hour: CVE Program records (incl. CISA-ADP), FIRST EPSS (updated daily) and the CISA KEV catalog. The verdict is a transparent rule set on public data, not a guarantee; your own exposure and compensating controls still decide. No key needed. Remote MCP server: https://kevscope-api.cybermax-tools.workers.dev/mcp\n\nPricing: free tier 200 calls/day per IP, no key. Paid API keys: Analyst $19/month = 10,000 calls/month; Team $49/month = 50,000 calls/month; SOC $99/month = 150,000 calls/month; Pay as you go $5 = 2,000 calls (one-time pack); Analyst yearly $190/year = 10,000 calls/month; Team yearly $490/year = 50,000 calls/month; SOC yearly $990/year = 150,000 calls/month. Get a key: https://kevscope-api.cybermax-tools.workers.dev/docs#pricing", "contact": { "name": "CyberMax", "url": "https://cybermax-tools-cybermax.static.hf.space/" }, "license": { "name": "Proprietary (free tier + paid API keys)", "identifier": "LicenseRef-CyberMax" }, "x-pricing": { "api": "Kevscope API", "currency": "USD", "free": { "price": 0, "callsPerDayPerIp": 200, "perMinutePerIp": 10, "key": "none needed" }, "plans": [ { "id": "analyst", "name": "Analyst", "price": 19, "billing": "per month", "calls": 10000, "per": "calendar month (UTC)", "perMinute": 30, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/analyst?s=openapi" }, { "id": "team", "name": "Team", "price": 49, "billing": "per month", "calls": 50000, "per": "calendar month (UTC)", "perMinute": 60, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/team?s=openapi" }, { "id": "soc", "name": "SOC", "price": 99, "billing": "per month", "calls": 150000, "per": "calendar month (UTC)", "perMinute": 120, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/soc?s=openapi" }, { "id": "payg", "name": "Pay as you go", "price": 5, "billing": "one-time", "calls": 2000, "per": "until used", "perMinute": 30, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/payg?s=openapi" }, { "id": "analyst-yearly", "name": "Analyst yearly", "price": 190, "billing": "per year", "calls": 10000, "per": "calendar month (UTC)", "perMinute": 30, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/analyst-yearly?s=openapi" }, { "id": "team-yearly", "name": "Team yearly", "price": 490, "billing": "per year", "calls": 50000, "per": "calendar month (UTC)", "perMinute": 60, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/team-yearly?s=openapi" }, { "id": "soc-yearly", "name": "SOC yearly", "price": 990, "billing": "per year", "calls": 150000, "per": "calendar month (UTC)", "perMinute": 120, "buy": "https://kevscope-api.cybermax-tools.workers.dev/buy/soc-yearly?s=openapi" } ], "unit": "calls", "howToUse": { "header": "x-api-key: YOUR_KEY", "alt": [ "Authorization: Bearer YOUR_KEY", "?key=YOUR_KEY" ], "mcp": "send the key as Authorization: Bearer YOUR_KEY", "usage": "https://kevscope-api.cybermax-tools.workers.dev/key" }, "manageKey": "https://kevscope-api.cybermax-tools.workers.dev/manage", "allAccess": { "name": "CyberMax API All-Access", "apis": 9, "url": "https://api-all-access.cybermax-tools.workers.dev/?s=openapi-kevscope-api", "plans": [ { "id": "all-access", "price": 119, "billing": "per month", "callsHere": 10000, "per": "calendar month (UTC)" }, { "id": "all-access-pack", "price": 32, "billing": "one-time", "callsHere": 2000, "per": "until used" } ], "note": "One key for every CyberMax API; Kevscope counts it separately." }, "payments": "Stripe Checkout: card, Apple Pay, Google Pay, Link; sales tax/VAT handled by Stripe. Cancel any time at https://kevscope-api.cybermax-tools.workers.dev/manage." } }, "servers": [ { "url": "https://kevscope-api.cybermax-tools.workers.dev" } ], "paths": { "/api/priority": { "get": { "tags": [ "Kevscope API" ], "summary": "Patch-priority verdict for up to 20 CVEs, with evidence", "description": "For each CVE: verdict (act_now / high / medium / low), a 0-100 sort score and the reasons; CISA KEV status (date added, due date, ransomware use, required action); FIRST EPSS score and percentile; CVSS with its source (CNA, else CISA-ADP); CISA SSVC decision points; title, vendor, product, CWE and links. Results come back most urgent first.", "operationId": "cvePriorityGet", "parameters": [ { "name": "cve", "in": "query", "required": false, "description": "One CVE ID, or up to 20 separated by commas or spaces (or POST {\"cves\": [...]}); IDs are also found inside pasted text", "schema": { "type": "string" }, "example": "CVE-2024-3400" }, { "name": "full", "in": "query", "required": false, "description": "Full description and affected products instead of the short form", "schema": { "type": "boolean", "default": false } } ], "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true }, "example": { "results": [ { "id": "CVE-2024-3400", "status": "ok", "priority": { "level": "act_now", "score": 100, "reasons": [ "In CISA KEV since 2024-04-12 (federal due date 2024-04-19)", "Known use in ransomware campaigns (CISA)", "CISA SSVC: exploitation active", "CISA SSVC: automatable", "EPSS 100.0% chance of exploitation in 30 days (top 0.1%)", "CVSS 10.0 CRITICAL (CNA)" ] }, "title": "PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect", "description": "A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the f…", "vendor": "Palo Alto Networks", "product": "PAN-OS", "published": "2024-04-12", "updated": "2025-10-21", "assigner": "palo_alto", "cwe": [ "CWE-77", "CWE-20" ], "cvss": { "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "source": "CNA" }, "epss": { "score": 0.99999, "percentile": 1, "date": "2026-09-26" }, "ssvc": { "exploitation": "active", "automatable": "yes", "technicalImpact": "total" }, "kev": { "listed": true, "dateAdded": "2024-04-12", "dueDate": "2024-04-19", "ransomware": true, "vendor": "Palo Alto Networks", "product": "PAN-OS", "name": "Palo Alto Networks PAN-OS Command Injection Vulnerability", "requiredAction": "Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule." }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2024-3400", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400" } }, { "id": "CVE-2024-6387", "status": "ok", "priority": { "level": "high", "score": 68, "reasons": [ "CISA SSVC: public proof of concept", "EPSS 99.5% chance of exploitation in 30 days (top 0.1%)", "CVSS 8.1 HIGH (CNA)" ] }, "title": "Openssh: regresshion - race condition in ssh allows rce/dos", "description": "A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "published": "2024-07-01", "updated": "2026-09-01", "assigner": "redhat", "cwe": [ "CWE-364" ], "cvss": { "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "source": "CNA" }, "epss": { "score": 0.99506, "percentile": 0.99944, "date": "2026-09-26" }, "ssvc": { "exploitation": "poc", "automatable": "no", "technicalImpact": "total" }, "kev": { "listed": false }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2024-6387", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-6387" } }, { "id": "CVE-2019-0001", "status": "ok", "priority": { "level": "medium", "score": 52, "reasons": [ "EPSS 3.0% chance of exploitation in 30 days (top 13%)", "CVSS 7.5 HIGH (CNA)" ] }, "title": "Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).", "description": "Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result…", "vendor": "Juniper Networks", "product": "Junos OS", "published": "2019-01-15", "updated": "2024-09-17", "assigner": "juniper", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0", "source": "CNA" }, "epss": { "score": 0.03049, "percentile": 0.87041, "date": "2026-09-26" }, "ssvc": null, "kev": { "listed": false }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2019-0001", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2019-0001" } } ], "count": 3, "summary": { "cves": 3, "actNow": 1, "high": 1, "medium": 1, "low": 0, "notFound": 0 }, "sources": { "kevCatalog": "2026.09.25", "epssDate": "2026-09-26", "cveRecords": "CVE Program (cveawg.mitre.org), CISA-ADP Vulnrichment" }, "note": "Sorted most urgent first. Verdict rules are public: act_now = in CISA KEV or SSVC exploitation active; high = EPSS >= 10%, an automatable or critical public PoC, or top-5% EPSS with CVSS >= 7; medium = CVSS >= 7, top-20% EPSS or a public PoC; low = the rest.", "checkedAt": "2026-09-27T07:57:04.019Z" } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "tags": [ "Kevscope API" ], "summary": "Patch-priority verdict for up to 20 CVEs, with evidence", "description": "For each CVE: verdict (act_now / high / medium / low), a 0-100 sort score and the reasons; CISA KEV status (date added, due date, ransomware use, required action); FIRST EPSS score and percentile; CVSS with its source (CNA, else CISA-ADP); CISA SSVC decision points; title, vendor, product, CWE and links. Results come back most urgent first.", "operationId": "cvePriorityPost", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "cves": { "type": "array", "items": { "type": "string" }, "maxItems": 20 }, "full": { "type": "boolean" } } }, "example": { "cves": [ "CVE-2024-3400", "CVE-2024-6387" ] } } } }, "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true }, "example": { "results": [ { "id": "CVE-2024-3400", "status": "ok", "priority": { "level": "act_now", "score": 100, "reasons": [ "In CISA KEV since 2024-04-12 (federal due date 2024-04-19)", "Known use in ransomware campaigns (CISA)", "CISA SSVC: exploitation active", "CISA SSVC: automatable", "EPSS 100.0% chance of exploitation in 30 days (top 0.1%)", "CVSS 10.0 CRITICAL (CNA)" ] }, "title": "PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect", "description": "A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the f…", "vendor": "Palo Alto Networks", "product": "PAN-OS", "published": "2024-04-12", "updated": "2025-10-21", "assigner": "palo_alto", "cwe": [ "CWE-77", "CWE-20" ], "cvss": { "score": 10, "severity": "CRITICAL", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1", "source": "CNA" }, "epss": { "score": 0.99999, "percentile": 1, "date": "2026-09-26" }, "ssvc": { "exploitation": "active", "automatable": "yes", "technicalImpact": "total" }, "kev": { "listed": true, "dateAdded": "2024-04-12", "dueDate": "2024-04-19", "ransomware": true, "vendor": "Palo Alto Networks", "product": "PAN-OS", "name": "Palo Alto Networks PAN-OS Command Injection Vulnerability", "requiredAction": "Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule." }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2024-3400", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-3400", "kev": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400" } }, { "id": "CVE-2024-6387", "status": "ok", "priority": { "level": "high", "score": 68, "reasons": [ "CISA SSVC: public proof of concept", "EPSS 99.5% chance of exploitation in 30 days (top 0.1%)", "CVSS 8.1 HIGH (CNA)" ] }, "title": "Openssh: regresshion - race condition in ssh allows rce/dos", "description": "A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.", "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "published": "2024-07-01", "updated": "2026-09-01", "assigner": "redhat", "cwe": [ "CWE-364" ], "cvss": { "score": 8.1, "severity": "HIGH", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "source": "CNA" }, "epss": { "score": 0.99506, "percentile": 0.99944, "date": "2026-09-26" }, "ssvc": { "exploitation": "poc", "automatable": "no", "technicalImpact": "total" }, "kev": { "listed": false }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2024-6387", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2024-6387" } }, { "id": "CVE-2019-0001", "status": "ok", "priority": { "level": "medium", "score": 52, "reasons": [ "EPSS 3.0% chance of exploitation in 30 days (top 13%)", "CVSS 7.5 HIGH (CNA)" ] }, "title": "Junos OS: MX Series: uncontrolled recursion and crash in Broadband Edge subscriber management daemon (bbe-smgd).", "description": "Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result…", "vendor": "Juniper Networks", "product": "Junos OS", "published": "2019-01-15", "updated": "2024-09-17", "assigner": "juniper", "cwe": [ "CWE-674" ], "cvss": { "score": 7.5, "severity": "HIGH", "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0", "source": "CNA" }, "epss": { "score": 0.03049, "percentile": 0.87041, "date": "2026-09-26" }, "ssvc": null, "kev": { "listed": false }, "links": { "cve": "https://www.cve.org/CVERecord?id=CVE-2019-0001", "nvd": "https://nvd.nist.gov/vuln/detail/CVE-2019-0001" } } ], "count": 3, "summary": { "cves": 3, "actNow": 1, "high": 1, "medium": 1, "low": 0, "notFound": 0 }, "sources": { "kevCatalog": "2026.09.25", "epssDate": "2026-09-26", "cveRecords": "CVE Program (cveawg.mitre.org), CISA-ADP Vulnrichment" }, "note": "Sorted most urgent first. Verdict rules are public: act_now = in CISA KEV or SSVC exploitation active; high = EPSS >= 10%, an automatable or critical public PoC, or top-5% EPSS with CVSS >= 7; medium = CVSS >= 7, top-20% EPSS or a public PoC; low = the rest.", "checkedAt": "2026-09-27T07:57:04.019Z" } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/kev/recent": { "get": { "tags": [ "Kevscope API" ], "summary": "CVEs added to CISA KEV in the last N days, with EPSS", "description": "Newest first: vendor, product, name, date added, federal due date, ransomware use, required action and EPSS. Filter by vendor/product text and ransomware use.", "operationId": "kevRecentGet", "parameters": [ { "name": "days", "in": "query", "required": false, "description": "Look-back window in days (1-365)", "schema": { "type": "integer", "default": 30 }, "example": "14" }, { "name": "vendor", "in": "query", "required": false, "description": "Only vendors or products containing this text, e.g. microsoft", "schema": { "type": "string" }, "example": "" }, { "name": "ransomware", "in": "query", "required": false, "description": "Only entries with known ransomware use", "schema": { "type": "boolean", "default": false } }, { "name": "limit", "in": "query", "required": false, "description": "Rows to return (1-100)", "schema": { "type": "integer", "default": 50 } } ], "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "tags": [ "Kevscope API" ], "summary": "CVEs added to CISA KEV in the last N days, with EPSS", "description": "Newest first: vendor, product, name, date added, federal due date, ransomware use, required action and EPSS. Filter by vendor/product text and ransomware use.", "operationId": "kevRecentPost", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "days": { "type": "integer" }, "vendor": { "type": "string" }, "ransomware": { "type": "boolean" }, "limit": { "type": "integer" } } }, "example": { "days": 14 } } } }, "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/api/watchlist": { "get": { "tags": [ "Kevscope API" ], "summary": "Early warning: highest-EPSS CVEs that are not in CISA KEV yet", "description": "The CVEs FIRST's EPSS rates most likely to be exploited in the next 30 days, minus those already in KEV. Defaults to this year's CVE IDs; year=all for every year.", "operationId": "epssWatchlistGet", "parameters": [ { "name": "year", "in": "query", "required": false, "description": "CVE ID year (e.g. 2026), or all", "schema": { "type": "string" }, "example": "" }, { "name": "limit", "in": "query", "required": false, "description": "Rows to return (1-50)", "schema": { "type": "integer", "default": 25 } }, { "name": "minEpss", "in": "query", "required": false, "description": "Only EPSS at or above this probability (0-1)", "schema": { "type": "number", "default": 0 } } ], "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } }, "post": { "tags": [ "Kevscope API" ], "summary": "Early warning: highest-EPSS CVEs that are not in CISA KEV yet", "description": "The CVEs FIRST's EPSS rates most likely to be exploited in the next 30 days, minus those already in KEV. Defaults to this year's CVE IDs; year=all for every year.", "operationId": "epssWatchlistPost", "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "year": { "type": "string" }, "limit": { "type": "integer" }, "minEpss": { "type": "number" } } }, "example": { "limit": 10 } } } }, "responses": { "200": { "description": "Results (same field names as the bulk version's dataset records) plus the free-tier limits.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "description": "Invalid input", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "401": { "description": "Invalid or revoked API key", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Free tier used up (200/day per IP) or rate/plan limit reached; the body has an upgrade link.", "headers": { "Retry-After": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "504": { "description": "Took too long; ask for fewer items", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } }, "components": { "schemas": { "Error": { "type": "object", "properties": { "error": { "type": "string" }, "message": { "type": "string" }, "retryAfterSeconds": { "type": "integer" }, "limits": { "type": "object" } }, "required": [ "error", "message" ] } }, "securitySchemes": { "ApiKeyHeader": { "type": "apiKey", "in": "header", "name": "x-api-key", "description": "Optional. Paid plan key from https://kevscope-api.cybermax-tools.workers.dev/docs#pricing; leave out for the free tier." }, "BearerKey": { "type": "http", "scheme": "bearer", "description": "Same key as a Bearer token." } } }, "x-mcp-server": "https://kevscope-api.cybermax-tools.workers.dev/mcp", "externalDocs": { "description": "Get an API key (pricing)", "url": "https://kevscope-api.cybermax-tools.workers.dev/docs#pricing" }, "security": [ {}, { "ApiKeyHeader": [] }, { "BearerKey": [] } ] }