Free API
Take the data
Static JSON, no key, no rate limit, no terms beyond crediting the upstream sources. If you can fetch a URL, you have an API.
Endpoints
| Endpoint | Returns |
|---|---|
/api/cve/index.json | All 1,655 exploited vulnerabilities, summarised |
/api/cve/cve-2025-68686.json | One full vulnerability record with verdict and evidence |
/api/enforcement/index.json | All 217 UK enforcement actions |
/api/enforcement/geoffrey-smith.json | One full enforcement record with cause and penalty |
/api/stats.json | Headline counts and totals |
/feed.xml | RSS: newly confirmed exploited vulnerabilities |
Example
curl -s https://black-hat.co.uk/api/cve/cve-2025-68686.json | jq '{id, verdict: .verdict.key, epss: .epss.score}'Fair use
There is no rate limit because there is no server to overload — everything is a static file behind a CDN. Mirror it, cache it, build on it. Credit CISA, NVD, FIRST and the ICO for the underlying data, and this site for the joins if you use them.