# Vulnerability Intelligence

URL: https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/

Snapshot · Last refresh 2026-10-29 20:01 UTC

## Track CVE Disclosures and CISA KEV Additions Week by Week.

Triage works one CVE at a time. Planning and reporting need the whole database: how many CVEs were published this week, what CISA added to its Known Exploited Vulnerabilities catalog, which weakness types keep coming back, how one product’s CVEs split by severity.

Deep Search & Insights returns those numbers as JSON, from the endpoints behind our public [Vulnerability Insights](https://www.deepinfo.com/insights/vulnerability/) page.

[Request demo](https://www.deepinfo.com/request-demo/) · [Vulnerability reference](https://docs.deepinfo.com/reference/vulnerability/) · [Platform guide: Vulnerability intelligence](https://docs.deepinfo.com/guide/dsi/vulnerability-intelligence/)

### The Endpoints Cover Velocity, Structure and One CVE Over Time.

The endpoints group by the question they answer. All of them live under `GET /explore/vulnerability-insight/` and return plain JSON.

Velocity

#### What Is New

CVEs published and modified in the last 1, 7 and 30 days, CISA KEV additions over the same windows, and the latest added CVEs, filterable by vendor, product, version and severity.

- `cve-stats`
- `cisa-kev-stats`
- `latest-added-vulnerabilities-list`

Structure

#### How the Database Is Shaped

CVE counts per year and severity back to 1988, the spread of CVEs by CVSS score, and the number of CVEs per weakness type (CWE) in each year.

- `vulnerability-severity-stats-by-year`
- `vulnerability-stats-by-cvss-scores`
- `cwe-timeline`

One CVE

#### How Its Odds Moved

The EPSS score and percentile of a single CVE for each day on record, so you can see when its estimated likelihood of exploitation changed.

- `epss-history/{cve}`

### Four Numbers Sum Up Thirty Days of Disclosures.

CVE Stats and CISA KEV Stats at the last Insights refresh, reloaded from the Insights cache when the page opens. Publication volume and evidence of exploitation move separately, so the row shows both.

- **Last 7 days**: 3,899 · CVEs published · CVE Stats
- **Last 30 days**: 17,897 · CVEs published · CVE Stats
- **Last 7 days**: 8 · added to CISA KEV · CISA KEV Stats
- **Last 30 days**: 34 · added to CISA KEV · CISA KEV Stats

[Vulnerability Insights](https://www.deepinfo.com/insights/vulnerability/)

### Split Each Year’s CVE Volume by Severity.

One call returns the CVE count for each year, broken into critical, high, medium, low and other. Add a vendor, a product or a version and the same call returns that product’s history.

GET `https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year` [Reference](https://docs.deepinfo.com/reference/vulnerability/severity-by-year-stats/)

| Parameter | Type |  | Description |
| --- | --- | --- | --- |
| `vendor` | string | Optional | Count only CVEs that affect this vendor. |
| `product` | string | Optional | Count only CVEs that affect this product. |
| `version` | string | Optional | Count only CVEs that affect this version. |
| `version__startswith` | string | Optional | Count only CVEs that affect versions with this prefix, such as one major release. |

Request

curl:

```bash
curl "https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year" \
  -H "apikey: YOUR_API_KEY"
```

Python:

```python
import requests

r = requests.get(
    "https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year",
    headers={"apikey": "YOUR_API_KEY"},
)
for y in r.json()["cve_count_by_year"][-3:]:
    print(y["year"], y["cve_count_by_severity"]["critical"])
```

JavaScript:

```javascript
const r = await fetch(
  'https://api.deepinfo.com/v1/explore/vulnerability-insight/vulnerability-severity-stats-by-year',
  { headers: { apikey: 'YOUR_API_KEY' } }
)
const { cve_count_by_year } = await r.json()
console.log(cve_count_by_year.slice(-3))
```

Response · from the Insights snapshot of 2026-10-29; the current year is partial

200 OK · application/json

```json
{
  "vendor": "",
  "product": "",
  "version": "",
  "cve_count": 416750,
  "cve_count_by_year": [
    "…",
    {
      "year": 2024,
      "cve_count": 40704,
      "cve_count_by_severity": {
        "critical": 4300, "high": 14036,
        "medium": 20755, "low": 853, "other": 760
      }
    },
    {
      "year": 2025,
      "cve_count": 49972,
      "cve_count_by_severity": {
        "critical": 4173, "high": 15905,
        "medium": 24064, "low": 3102, "other": 2728
      }
    },
    {
      "year": 2026,
      "cve_count": 91473,
      "cve_count_by_severity": {
        "critical": 9872, "high": 36339,
        "medium": 32937, "low": 6017, "other": 6308
      }
    }
  ]
}
```

### Follow One CVE’s EPSS Day by Day.

EPSS estimates the probability that a CVE is exploited in the next 30 days, and the estimate is recalculated as new evidence arrives. A single current score hides when the change happened.

EPSS History returns the score and percentile for each day on record. Set it against your patch dates and you can see whether a fix landed before or after the likelihood climbed.

[EPSS History reference](https://docs.deepinfo.com/reference/vulnerability/epss-history/)

Request:

```bash
curl "https://api.deepinfo.com/v1/explore/vulnerability-insight/epss-history/CVE-2021-44228" \
  -H "apikey: YOUR_API_KEY"
```

Response:

```json
{
  "cve": "CVE-2021-44228",
  "records": [
    { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-21" },
    { "epss": 0.99999, "percentile": 1.0, "date": "2026-09-20" },
    "…"
  ]
}
```

### Where the Numbers End Up.

#### [Vulnerability Management](https://www.deepinfo.com/solutions/use-cases/vulnerability-management/)

Check each week’s KEV additions against the products you run, and pull the newest CVEs for your stack with the Latest Added filters.

#### [Threat Intelligence Reporting](https://www.deepinfo.com/solutions/use-cases/threat-intelligence-operations/)

Disclosure volume, severity mix and the weakness types on the rise, for a weekly or quarterly brief, from one source.

#### [Supplier Due Diligence](https://www.deepinfo.com/solutions/use-cases/supply-chain-security/)

A supplier product’s CVE history by year and severity, and the spread of its CVSS scores, before it goes into your estate.

#### Secure Development

The CWE timeline shows which weakness types dominate each year’s disclosures. That is a measured input for training plans and code review checklists.

### From the Trend to the CVE Record.

- [Vulnerability Search](https://www.deepinfo.com/platform/dsi/vulnerability-search/) (DSI): Filter the CVE database on severity, weakness, product, EPSS and CISA KEV.
- [Risk Scoring](https://www.deepinfo.com/platform/easm/complete-risk-scoring/) (EASM): CVSS, EPSS and CISA KEV applied to the CVEs found on your assets.
- [Domain Intelligence](https://www.deepinfo.com/platform/dsi/domain-intelligence/) (DSI): A matching view over new domain registrations.

### Query This Data Through the API

Everything Deep Search & Insights shows in the Deepinfo Platform is also available as data, through the API and as bulk feeds.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/)
- [Data Feeds](https://www.deepinfo.com/data-api/feeds/)

### Questions About Vulnerability Intelligence

**What is the difference between published and modified?**

Published counts new CVE records. Modified counts changes to existing records, such as CVSS metrics added after analysis, new affected products or new references.

**Do the stats cover all CVEs or only ours?**

All CVEs in Deepinfo’s database. The CVEs found on your own assets, ranked for your team, are in [External Attack Surface Management](https://www.deepinfo.com/platform/easm/complete-risk-scoring/).

**Why do some recent CVEs have no CVSS score?**

A CVE record can be published before any CVSS metrics are attached. The record’s `status` shows how far analysis has gone, and `last_modified` changes when scores are added.

**Where does EPSS come from?**

EPSS is the Exploit Prediction Scoring System, published by FIRST. Deepinfo attaches the score and percentile to each CVE record and keeps the daily history that EPSS History returns.

**Where does the CISA KEV data come from?**

From the Known Exploited Vulnerabilities catalog that CISA publishes. Once a CVE is listed, its record carries the KEV entry with the date added, the due date and the required action.

**Can we narrow the trends to one vendor or product?**

Severity by year, CVSS score stats and Latest Added accept `vendor`, `product`, `version` and `version__startswith`. CVE Stats, CISA KEV Stats and the CWE timeline cover the whole database.

### Ask the CVE Database a Structural Question.

Book a demo with a vendor, a product or a weakness class in mind. We query the trend endpoints with you and read the results together.

[Request demo](https://www.deepinfo.com/request-demo/) [Talk to us about API access](https://www.deepinfo.com/contact/)