EPSS + KEV intelligence for a CVE
API · /vulnintel-api
Vulnerability Intelligence API
healthy
4,379 Subscribers
Prioritise CVEs by real-world exploitation risk — not just severity. Combines the FIRST.org EPSS score (the probability, 0 to 1, that a CVE will be exploited in the next 30 days, with its percentile rank) and the CISA KEV catalog (vulnerabilities confirmed to be actively exploited in the wild — with the vendor, product, date added, remediation due date and whether the flaw is used in ransomware campaigns), and derives a single priority level for each CVE. Look up to 25 CVEs in one call, browse the full CISA Known Exploited Vulnerabilities catalog filtered by vendor, product or ransomware use, or list the CVEs with the highest current EPSS scores. Built for vulnerability management, patch prioritisation, risk scoring and security dashboards — answering not "how bad could this be?" but "how likely is it to actually be exploited?". A vulnerability-prioritisation layer — distinct from raw CVE details and CVSS severity (cve), password-breach checks (pwned) and the HTTP security-header grader (secheaders). Data live from FIRST.org and CISA. No upstream key, no cache.
api.oanor.com/vulnintel-api
API health
healthy- Uptime
- 100.00%
- Server probes · 24h
- Avg latency
- 122 ms
- Server probes · 24h
- Subscribers
- 4,379
- active
- Total calls
- 76
- last 7 days
Pricing
Pick a tier — billed monthly, cancel anytime.
Free
Free
- 2,320 calls / month
- 2 requests / second
- Hard cap (429 above quota, no overage)
- 2,320 calls/month
- 2 req/sec
- EPSS + KEV + priority
- No credit card
Starter
€6.75 /month
- 46,000 calls / month
- 8 requests / second
- Hard cap (429 above quota, no overage)
- 46k calls/month
- 8 req/sec
- Batch CVEs + KEV browse
- Email support
Pro
€21.40 /month
- 236,000 calls / month
- 20 requests / second
- Hard cap (429 above quota, no overage)
- 236k calls/month
- 20 req/sec
- Vuln-management pipelines
- Priority support
Mega
€56.20 /month
- 870,000 calls / month
- 50 requests / second
- Hard cap (429 above quota, no overage)
- 870k calls/month
- 50 req/sec
- Security-dashboard scale
- Dedicated SLA
Built by
Related APIs
Other APIs with overlapping tags.
CVE Vulnerability API
Look up software vulnerabilities by their CVE identifier and get clean, structured details — title, description, CVSS score, severity and vector, CWE weakness types, affected vendors and products with version ranges, and reference links — plus search every CVE that affects a given vendor or product, and stream the most recently published CVEs. Sourced from the CIRCL CVE Search service over the official CVE Record 5.1 data and returned as tidy JSON through a fast, reliable API. Ideal for vulnerability management and SOC tooling, DevSecOps and SCA pipelines, security dashboards, compliance and asset-risk monitoring.
api.oanor.com/cve-api
OSV Vulnerabilities API
The Open Source Vulnerabilities database (OSV / osv.dev) as an API — the supply-chain security check for open-source dependencies. Scan any package version (PyPI, npm, Go, crates.io, Maven, NuGet, RubyGems, Packagist, Hex and more) and instantly learn whether it is affected by known vulnerabilities, with each advisory's severity, CVSS score, CVE aliases, CWE weakness and references; list every advisory ever published for a package; and look up a single advisory (GHSA, PYSEC, GO, RUSTSEC, CVE…) in full detail, including the affected packages and version ranges. Live from Google's official OSV.dev database, which aggregates GitHub Security Advisories, PyPA, RustSec, Go and many other sources. Ideal for dependency scanning, SBOM and supply-chain tooling, CI security gates and devsecops dashboards. Open data.
api.oanor.com/osv-api
Shentu API
Live on-chain data for Shentu (chain id shentu-2.2) — the security-focused Cosmos-SDK Layer-1 of the CertiK ecosystem, whose native token is CTK — served directly from public LCD/REST nodes with multi-node failover. The status endpoint returns the latest block height and time, chain id, the staking bond denom and the current minting inflation rate. The validators endpoint lists the active bonded validator set ranked by stake, each with its moniker, operator address, self-plus-delegated CTK, commission rate and jailed flag. The supply endpoint returns the total CTK supply, the amount bonded in staking and the resulting bonded ratio. The governance endpoint returns the most recent on-chain proposals with their id, title, status and voting window. Token amounts are converted from base micro-CTK (6 decimals) into whole CTK, and every figure is read live from the chain — nothing bundled or modelled — behind a short server-side cache with keep-warm so the feed stays fast and fresh. Ideal for staking dashboards, validator and delegator tooling, explorers, governance trackers and portfolio or analytics apps across the Cosmos and security-infrastructure ecosystem. Live keyless upstream. 5 endpoints.
api.oanor.com/shentu-api
Solana Program API
Inspect deployed Solana programs live from public Solana RPC — no key — and answer the question that matters most for safety: can this program still be changed, and by whom? For any program address it resolves the loader it runs under, whether it is executable, its on-chain ProgramData account, the upgrade authority (or that it has been made immutable / frozen), and the slot it was last deployed at. A batch endpoint audits up to twelve programs at once — perfect for checking the upgrade authority of every program a protocol depends on before you trust it — and a loaders endpoint documents Solana's program loaders. Distinct from balance, token and transaction APIs: this is the program and upgrade-authority layer that auditors, wallets and security tooling rely on to judge whether a Solana program is safe. Live from the chain; short cache only.
api.oanor.com/solanaprogram-api
Frequently asked questions
Quick answers about pricing, quotas, and integration.
How do I get an API key for Vulnerability Intelligence API?
Sign up for free at oanor.com, generate an API key from the developer dashboard, and call Vulnerability Intelligence API with the x-oanor-key header. No credit card needed for the free tier.
What's the rate limit for Vulnerability Intelligence API?
Free tier allows 1 request per second. Paid plans scale up to 50 requests per second on the Mega tier. Hard limits return HTTP 429 above the quota — no surprise overage charges.
How much does Vulnerability Intelligence API cost?
Vulnerability Intelligence API has a free tier with 100 calls / month. Paid plans start at €6.75 / month with higher quotas and faster rate limits.
Can I cancel my subscription anytime?
Yes. Plans are billed monthly and you can cancel anytime from your billing dashboard. No long-term contracts and no cancellation fee.
Is Vulnerability Intelligence API GDPR-compliant?
All requests to Vulnerability Intelligence API go through our EU-based gateway. Your upstream API key never leaves our server and no personal data is shared with the upstream provider beyond the request you send.
Pick an endpoint from the list on the left to see its details and try it.
Code snippets
Sign up to get an API key, then call any path under your slug.
curl https://api.oanor.com/vulnintel-api/SOME_PATH \
-H "x-oanor-key: oanor_test_..."const res = await fetch("https://api.oanor.com/vulnintel-api/SOME_PATH", {
headers: { "x-oanor-key": "oanor_test_..." }
});
const data = await res.json();$ch = curl_init("https://api.oanor.com/vulnintel-api/SOME_PATH");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
$response = curl_exec($ch);import requests
r = requests.get(
"https://api.oanor.com/vulnintel-api/SOME_PATH",
headers={"x-oanor-key": "oanor_test_..."},
)
print(r.json())Ratings
Sign in to rate.
No reviews yet.
Discussion
Ask questions, share usage tips, get answers from the provider and other developers. Public — anyone can read.
Sign in to start a thread or reply.
Sign inNew thread
📌 Pinned
🔒 Locked
·
·
·
-
Provider answer
🔒 This thread is locked — no new replies.
-
·
- No threads yet — start the discussion.
Support
Private 1:1 support with the provider — billing questions, integration issues, account problems. Only you and the provider team can see these threads.
Sign in to open a support ticket.
Sign inOpen new ticket
Describe what you need help with. The provider team gets an email and replies on the ticket page.
-
·
Urgent - No tickets yet for this API.