---
updatedAt: 2026-06-02T19:39:26.000Z
agentTools:
  projectIndex: https://docs.greynoise.io/llms.txt
---

# List CVEs

Return CVE records tracked by GreyNoise, ordered by publication date,
last-update date, or CVSS score. Default cap is 100 records, configurable
up to 1000 via the `limit` query parameter.

This endpoint requires the `feature-search-cves-bulk` entitlement.
Response payload is shaped according to the caller's CVE Insights tier
(minimal, basic, or advanced).


# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "info": {
    "description": "GreyNoise is a cybersecurity company that collects and analyzes Internet-wide scan and attack traffic. Use GreyNoise to contextualize existing alerts, filter false-positives, identify compromised devices, and track emerging threats.",
    "version": "3.0.0",
    "title": "GreyNoise API",
    "contact": {
      "email": "hello@greynoise.io"
    },
    "license": {
      "name": "Proprietary",
      "url": "https://www.greynoise.io/terms"
    }
  },
  "tags": [
    {
      "name": "CVE",
      "description": "Endpoints that are used for retrieving information about Common Vulnerabilities and Exposures (CVEs).\n"
    }
  ],
  "security": [
    {
      "APIKeyHeaderAuth": []
    }
  ],
  "paths": {
    "/v3/cves/list": {
      "get": {
        "operationId": "listCVEs",
        "tags": [
          "CVE"
        ],
        "summary": "List CVEs",
        "description": "Return CVE records tracked by GreyNoise, ordered by publication date,\nlast-update date, or CVSS score. Default cap is 100 records, configurable\nup to 1000 via the `limit` query parameter.\n\nThis endpoint requires the `feature-search-cves-bulk` entitlement.\nResponse payload is shaped according to the caller's CVE Insights tier\n(minimal, basic, or advanced).\n",
        "parameters": [
          {
            "in": "query",
            "name": "sort",
            "required": false,
            "schema": {
              "type": "string",
              "enum": [
                "published",
                "updated",
                "cvss"
              ],
              "default": "published"
            },
            "description": "Field to sort by."
          },
          {
            "in": "query",
            "name": "order",
            "required": false,
            "schema": {
              "type": "string",
              "enum": [
                "desc",
                "asc"
              ],
              "default": "desc"
            },
            "description": "Sort direction."
          },
          {
            "in": "query",
            "name": "exploitable_only",
            "required": false,
            "schema": {
              "type": "boolean",
              "default": false
            },
            "description": "When true, restrict to CVEs with attack_vector=\"Network\"."
          },
          {
            "in": "query",
            "name": "limit",
            "required": false,
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 1000,
              "default": 100
            },
            "description": "Maximum number of CVE records to return."
          }
        ],
        "responses": {
          "200": {
            "description": "OK - request successful.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "cves": {
                      "type": "array",
                      "items": {
                        "oneOf": [
                          {
                            "$ref": "#/components/schemas/CVEAdvancedResponse"
                          },
                          {
                            "$ref": "#/components/schemas/CVEBasicResponse"
                          },
                          {
                            "$ref": "#/components/schemas/CVEMinimalResponse"
                          }
                        ]
                      }
                    },
                    "generated_at": {
                      "type": "string",
                      "format": "date-time",
                      "description": "Timestamp when the response was produced."
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Bad request — unknown sort/order, bad limit, or invalid exploitable_only.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "403": {
            "description": "Forbidden — caller lacks the bulk CVE search entitlement.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/Error"
                }
              }
            }
          },
          "500": {
            "$ref": "#/components/responses/UnexpectedError"
          }
        }
      }
    }
  },
  "servers": [
    {
      "url": "https://api.greynoise.io"
    },
    {
      "url": "http://api.greynoise.io"
    }
  ],
  "components": {
    "securitySchemes": {
      "APIKeyHeaderAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "key"
      }
    },
    "responses": {
      "UnexpectedError": {
        "description": "Unexpected error",
        "content": {
          "application/json": {
            "schema": {
              "$ref": "#/components/schemas/ErrorMessage"
            },
            "example": {
              "message": "Encountered error while performing request"
            }
          }
        }
      }
    },
    "schemas": {
      "Error": {
        "type": "object",
        "properties": {
          "error": {
            "type": "string"
          }
        },
        "required": [
          "error"
        ]
      },
      "ErrorMessage": {
        "type": "object",
        "properties": {
          "message": {
            "type": "string"
          }
        },
        "required": [
          "message"
        ]
      },
      "CVEAdvancedResponse": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The CVE identifier.",
            "example": "CVE-2024-12345"
          },
          "details": {
            "$ref": "#/components/schemas/CVEDetails"
          },
          "timeline": {
            "$ref": "#/components/schemas/CVETimeline"
          },
          "exploitation_details": {
            "$ref": "#/components/schemas/CVEExploitationDetails"
          },
          "exploitation_stats": {
            "$ref": "#/components/schemas/CVEExploitationStats"
          },
          "exploitation_activity": {
            "$ref": "#/components/schemas/CVEExploitationActivity"
          }
        }
      },
      "CVEBasicResponse": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The CVE identifier.",
            "example": "CVE-2024-12345"
          },
          "details": {
            "$ref": "#/components/schemas/CVEDetails"
          },
          "timeline": {
            "$ref": "#/components/schemas/CVETimeline"
          },
          "exploitation_details": {
            "$ref": "#/components/schemas/CVEExploitationDetails"
          }
        }
      },
      "CVEMinimalResponse": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string",
            "description": "The CVE identifier.",
            "example": "CVE-2024-12345"
          },
          "details": {
            "$ref": "#/components/schemas/CVEDetails"
          }
        }
      },
      "CVEDetails": {
        "type": "object",
        "properties": {
          "vulnerability_name": {
            "type": "string",
            "description": "The name of the vulnerability.",
            "example": "Sample Vulnerability"
          },
          "vulnerability_description": {
            "type": "string",
            "description": "Description of the vulnerability.",
            "example": "This vulnerability allows remote attackers to execute arbitrary code."
          },
          "cve_cvss_score": {
            "type": "number",
            "description": "The CVSS score of the CVE.",
            "example": 7.5
          },
          "product": {
            "type": "string",
            "description": "The product affected by the vulnerability.",
            "example": "Sample Product"
          },
          "vendor": {
            "type": "string",
            "description": "The vendor of the affected product.",
            "example": "Sample Vendor"
          },
          "published_to_nist_nvd": {
            "type": "boolean",
            "description": "Whether the CVE is published to the NIST National Vulnerability Database.",
            "example": true
          }
        }
      },
      "CVETimeline": {
        "type": "object",
        "properties": {
          "cve_published_date": {
            "type": "string",
            "format": "date",
            "description": "The date the CVE was published.",
            "example": "2024-01-01"
          },
          "cve_last_updated_date": {
            "type": "string",
            "format": "date",
            "description": "The date the CVE was last updated.",
            "example": "2024-01-02"
          },
          "first_known_published_date": {
            "type": "string",
            "format": "date",
            "description": "The first known published date of the CVE.",
            "example": "2024-01-01"
          },
          "cisa_kev_date_added": {
            "type": "string",
            "format": "date",
            "description": "The date the CVE was added to the CISA KEV list.",
            "example": "2024-01-03"
          }
        }
      },
      "CVEExploitationDetails": {
        "type": "object",
        "properties": {
          "attack_vector": {
            "type": "string",
            "description": "The attack vector for the CVE.",
            "example": "Network"
          },
          "exploit_found": {
            "type": "boolean",
            "description": "Whether an exploit has been found for this CVE.",
            "example": true
          },
          "exploitation_registered_in_kev": {
            "type": "boolean",
            "description": "Whether the exploitation is registered in KEV.",
            "example": true
          },
          "epss_score": {
            "type": "number",
            "description": "The EPSS score for the CVE.",
            "example": 0.8
          }
        }
      },
      "CVEExploitationStats": {
        "type": "object",
        "properties": {
          "number_of_available_exploits": {
            "type": "integer",
            "description": "The number of available exploits for the CVE.",
            "example": 5
          },
          "number_of_threat_actors_exploiting_vulnerability": {
            "type": "integer",
            "description": "The number of threat actors exploiting the vulnerability.",
            "example": 3
          },
          "number_of_botnets_exploiting_vulnerability": {
            "type": "integer",
            "description": "The number of botnets exploiting the vulnerability.",
            "example": 2
          }
        }
      },
      "CVEExploitationActivity": {
        "type": "object",
        "properties": {
          "activity_seen": {
            "type": "boolean",
            "description": "Whether exploitation activity has been observed.",
            "example": true
          },
          "benign_ip_count_1d": {
            "type": "integer",
            "description": "The count of benign IPs seen exploiting the CVE in the last 24 hours (rolling).",
            "example": 100
          },
          "benign_ip_count_10d": {
            "type": "integer",
            "description": "The count of benign IPs seen exploiting the CVE since 00:00 UTC 10 days ago.",
            "example": 500
          },
          "benign_ip_count_30d": {
            "type": "integer",
            "description": "The count of benign IPs seen exploiting the CVE since 00:00 UTC 30 days ago.",
            "example": 1000
          },
          "threat_ip_count_1d": {
            "type": "integer",
            "description": "The count of IPs with any classification other than benign seen exploiting the CVE in the last 24 hours (rolling).",
            "example": 10
          },
          "threat_ip_count_10d": {
            "type": "integer",
            "description": "The count of IPs with any classification other than benign seen exploiting the CVE since 00:00 UTC 10 days ago.",
            "example": 50
          },
          "threat_ip_count_30d": {
            "type": "integer",
            "description": "The count of IPs with any classification other than benign seen exploiting the CVE since 00:00 UTC 30 days ago.",
            "example": 100
          }
        }
      }
    }
  }
}
```