Cyber threats (CISA, EPSS, NVD, GDELT)

CEV-OS / Data API / Cyber threats (CISA, EPSS, NVD, GDELT)

CEV-OS Data API · last updated 2026-11-04. Status: live. Version 1.

Use this when you need recent CISA KEV entries (with EPSS/NVD enrichment), CISA advisories, and GDELT cyber-article links, optionally filtered by country.

What it is

CISA Known Exploited Vulnerabilities (last 30 days, CC0; no CISA logo or endorsement) with FIRST EPSS scores and NIST NVD CVSS where available, CISA cybersecurity advisories (countries named in the text), and GDELT GKG cyber-attack article links coarsened to country (off-topic items such as general tax news are dropped). Citation required for GDELT. No coordinates.

Endpoints

REST: GET /v1/cyber-threats on https://api.cev-os.com
Legacy host (same service): GET /v1/cyber-threats on https://cev-os.com
MCP tool: get_cyber_threats on https://mcp.cev-os.com/mcp

Parameters

Query parameters for `GET /v1/cyber-threats`
Name	Type	Description	Constraints
`country`	string	ISO 3166-1 alpha-2: keep CISA advisories and GDELT articles that name that country. KEV is global.	example US; pattern ^[A-Za-z]{2}$

Example request

No account and no key. Query values below are the examples or defaults from the registry. An optional free key (header x-api-key) raises the limits; create one at https://cev-os.com/#api_keys after signing in with a verified email (Google sign-in is already verified).

curl -s "https://api.cev-os.com/v1/cyber-threats?country=US"

Example response

Every /v1 response is a JSON envelope (schema_version, product, timestamps, license, attribution, data). The registry example is the data member:

{
  "kev_count": 1,
  "advisories_count": 1,
  "articles_count": 1,
  "kev": [
    {
      "title": "CVE-2024-1234: Vendor Product",
      "date": "2026-10-20",
      "epss": 0.81,
      "cvss": 9.8,
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1234"
    }
  ],
  "advisories": [
    {
      "title": "CISA advisory",
      "countries": [
        "US"
      ],
      "url": "https://www.cisa.gov/"
    }
  ],
  "articles": [
    {
      "country": "US",
      "time": "2026-11-01T12:00:00Z",
      "url": "https://example.com/cyber"
    }
  ]
}

Update frequency

TRIPWIRE: KEV every 6 h, CISA advisories hourly, GDELT cyber every 15 min; Data API caches 5 min.

Public cache: 300 seconds (Cache-Control: public, max-age=300).

Sources, license and usage

License status: cleared with attribution. CISA KEV is CC0 (no CISA logo or endorsement). CISA advisories and NVD are US Government work. EPSS: attribute FIRST. GDELT: citation required.

Underlying sources
Source	License	commercialOk	Terms
CISA Known Exploited Vulnerabilities Catalog	CC0 1.0; no CISA logo or endorsement	true	—
CISA cybersecurity advisories	US Government work (public domain); no CISA logo or endorsement	true	—
FIRST Exploit Prediction Scoring System (EPSS)	Attribution requested by FIRST	true	https://www.first.org/epss/
NIST National Vulnerability Database	US Government work (public domain)	true	—
The GDELT Project	Free, unrestricted use incl. commercial, with citation and link	true	https://www.gdeltproject.org/about.html

Attribution (show this wherever you display the data):

CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). No CISA logo or endorsement.
CISA cybersecurity advisories (US Government work). No CISA logo or endorsement.
EPSS scores: FIRST.org (https://www.first.org/epss/).
CVSS enrichment: NIST National Vulnerability Database.
The GDELT Project (https://www.gdeltproject.org/); citation required.

Privacy class: public-derived. Access: public. Price: free (price is null; pay-per-call is not active).

Disclaimer

Informational. Not an official CISA or FIRST product. No CISA endorsement.

Data API hub (all products, limits, license notes)
MCP Registry listing com.cev-os/data
OpenAPI 3.1
Machine product list: /v1/products

Reference data, not investment advice.