{
 "schema": "threatline.index/1",
 "name": "Threatline",
 "description": "Source-linked vulnerability and patch intelligence for people and agents: CISA KEV exploitation, EPSS, affected and fixed versions, merged from five public sources.",
 "site": "https://threatline.ai",
 "generated_at": "2026-10-24T10:48:42.330819Z",
 "record_count": 19569,
 "coverage": "Every CISA KEV entry, every CVE published in the last 30 days, GitHub reviewed advisories updated in that window, advisories from 25 watched vendor repositories, and older records that are known exploited, critical (CVSS 9+) or likely exploited (EPSS 10%+). Not every CVE ever published.",
 "notes": [
  "Static, read-only, public. Query strings are ignored.",
  "Missing paths under /api/ return HTTP 404 with a JSON body.",
  "Refreshed hourly. Read /api/v1/health.json for source freshness first.",
  "For the whole corpus, read /api/v1/catalog.json and fetch /api/v1/cve/{id}.json for each record you need."
 ],
 "endpoints": {
  "health": "/api/v1/health.json",
  "catalog": "/api/v1/catalog.json",
  "record": "/api/v1/cve/{id}.json",
  "changes": "/api/v1/changes.json",
  "incidents": "/api/v1/incidents.json",
  "signals": "/api/v1/signals.json",
  "campaigns": "/api/v1/campaigns.json",
  "compromises": "/api/v1/compromises.json",
  "brief": "/api/v1/brief.json",
  "products": "/api/v1/products.json",
  "skill": "/.well-known/skills/threatline-feed/SKILL.md",
  "llms": "/llms.txt"
 },
 "feeds": [
  {
   "slug": "latest",
   "name": "Latest changes",
   "description": "Vulnerability records most recently changed at their source.",
   "layer": null,
   "matching": 19569,
   "items": 100,
   "atom": "/feeds/latest/atom.xml",
   "rss": "/feeds/latest/rss.xml",
   "json": "/feeds/latest/feed.json"
  },
  {
   "slug": "exploited",
   "name": "Known exploited",
   "description": "Latest additions to the CISA Known Exploited Vulnerabilities catalog.",
   "layer": null,
   "matching": 1756,
   "items": 100,
   "atom": "/feeds/exploited/atom.xml",
   "rss": "/feeds/exploited/rss.xml",
   "json": "/feeds/exploited/feed.json"
  },
  {
   "slug": "ransomware",
   "name": "Ransomware use",
   "description": "Known exploited vulnerabilities that CISA links to ransomware campaigns.",
   "layer": null,
   "matching": 361,
   "items": 100,
   "atom": "/feeds/ransomware/atom.xml",
   "rss": "/feeds/ransomware/rss.xml",
   "json": "/feeds/ransomware/feed.json"
  },
  {
   "slug": "fixes",
   "name": "Fix available",
   "description": "Records whose sources name at least one fixed version.",
   "layer": null,
   "matching": 9944,
   "items": 100,
   "atom": "/feeds/fixes/atom.xml",
   "rss": "/feeds/fixes/rss.xml",
   "json": "/feeds/fixes/feed.json"
  },
  {
   "slug": "critical",
   "name": "Critical severity",
   "description": "Records with a CVSS base score of 9.0 or higher.",
   "layer": null,
   "matching": 2244,
   "items": 100,
   "atom": "/feeds/critical/atom.xml",
   "rss": "/feeds/critical/rss.xml",
   "json": "/feeds/critical/feed.json"
  },
  {
   "slug": "layer-operating-systems",
   "name": "Operating systems",
   "description": "Vulnerability records classified under Operating systems.",
   "layer": "Operating systems",
   "matching": 3358,
   "items": 50,
   "atom": "/feeds/layer-operating-systems/atom.xml",
   "rss": "/feeds/layer-operating-systems/rss.xml",
   "json": "/feeds/layer-operating-systems/feed.json"
  },
  {
   "slug": "layer-runtimes-languages",
   "name": "Runtimes & languages",
   "description": "Vulnerability records classified under Runtimes & languages.",
   "layer": "Runtimes & languages",
   "matching": 208,
   "items": 50,
   "atom": "/feeds/layer-runtimes-languages/atom.xml",
   "rss": "/feeds/layer-runtimes-languages/rss.xml",
   "json": "/feeds/layer-runtimes-languages/feed.json"
  },
  {
   "slug": "layer-web-servers",
   "name": "Web servers",
   "description": "Vulnerability records classified under Web servers.",
   "layer": "Web servers",
   "matching": 130,
   "items": 50,
   "atom": "/feeds/layer-web-servers/atom.xml",
   "rss": "/feeds/layer-web-servers/rss.xml",
   "json": "/feeds/layer-web-servers/feed.json"
  },
  {
   "slug": "layer-frameworks",
   "name": "Frameworks",
   "description": "Vulnerability records classified under Frameworks.",
   "layer": "Frameworks",
   "matching": 380,
   "items": 50,
   "atom": "/feeds/layer-frameworks/atom.xml",
   "rss": "/feeds/layer-frameworks/rss.xml",
   "json": "/feeds/layer-frameworks/feed.json"
  },
  {
   "slug": "layer-databases",
   "name": "Databases",
   "description": "Vulnerability records classified under Databases.",
   "layer": "Databases",
   "matching": 233,
   "items": 50,
   "atom": "/feeds/layer-databases/atom.xml",
   "rss": "/feeds/layer-databases/rss.xml",
   "json": "/feeds/layer-databases/feed.json"
  },
  {
   "slug": "layer-libraries-packages",
   "name": "Libraries & packages",
   "description": "Vulnerability records classified under Libraries & packages.",
   "layer": "Libraries & packages",
   "matching": 1400,
   "items": 50,
   "atom": "/feeds/layer-libraries-packages/atom.xml",
   "rss": "/feeds/layer-libraries-packages/rss.xml",
   "json": "/feeds/layer-libraries-packages/feed.json"
  },
  {
   "slug": "layer-network-edge",
   "name": "Network & edge",
   "description": "Vulnerability records classified under Network & edge.",
   "layer": "Network & edge",
   "matching": 907,
   "items": 50,
   "atom": "/feeds/layer-network-edge/atom.xml",
   "rss": "/feeds/layer-network-edge/rss.xml",
   "json": "/feeds/layer-network-edge/feed.json"
  },
  {
   "slug": "layer-applications-cms",
   "name": "Applications & CMS",
   "description": "Vulnerability records classified under Applications & CMS.",
   "layer": "Applications & CMS",
   "matching": 2991,
   "items": 50,
   "atom": "/feeds/layer-applications-cms/atom.xml",
   "rss": "/feeds/layer-applications-cms/rss.xml",
   "json": "/feeds/layer-applications-cms/feed.json"
  },
  {
   "slug": "layer-containers-cloud",
   "name": "Containers & cloud",
   "description": "Vulnerability records classified under Containers & cloud.",
   "layer": "Containers & cloud",
   "matching": 141,
   "items": 50,
   "atom": "/feeds/layer-containers-cloud/atom.xml",
   "rss": "/feeds/layer-containers-cloud/rss.xml",
   "json": "/feeds/layer-containers-cloud/feed.json"
  },
  {
   "slug": "layer-identity-access",
   "name": "Identity & access",
   "description": "Vulnerability records classified under Identity & access.",
   "layer": "Identity & access",
   "matching": 90,
   "items": 50,
   "atom": "/feeds/layer-identity-access/atom.xml",
   "rss": "/feeds/layer-identity-access/rss.xml",
   "json": "/feeds/layer-identity-access/feed.json"
  },
  {
   "slug": "layer-industrial-iot",
   "name": "Industrial & IoT",
   "description": "Vulnerability records classified under Industrial & IoT.",
   "layer": "Industrial & IoT",
   "matching": 78,
   "items": 50,
   "atom": "/feeds/layer-industrial-iot/atom.xml",
   "rss": "/feeds/layer-industrial-iot/rss.xml",
   "json": "/feeds/layer-industrial-iot/feed.json"
  }
 ]
}