Developers
JSON API
Read-only, no key, CORS enabled, cached for 60 seconds at the edge. The same queries power the site, so anything you can filter on a page you can fetch as JSON. Please send a descriptive User-Agent and respect Cache-Control.
GET /api/items
Filtered, ranked list with cursor pagination. All parameters are optional.
| Parameter | Values | Notes |
|---|---|---|
category | vuln,advisory,research,news,standards,policy | Comma-separated; default all. |
window | today (24h, default), 7d, 30d, all | Relative to the snapshot clock. |
sort | priority (default), newest | Rank includes the recency bonus. |
q | text | Literal substring search over title, summary, CVEs, vendors, products and source. Operators: vendor:, product:, source:, cve:; quote multi-word values. |
kev, exploited, patched | 1 | KEV-listed; KEV or confirmed exploitation; fix available. |
cvss | 0–10 | Minimum CVSS base score. |
vendor, source, cve | text / source id / CVE id | Exact vendor tag; source id (see /api/sources) or name fragment; one CVE id. |
ids | comma-separated item ids | Up to 100; used by the reading list. |
limit | 1–2000 | Default 50 (the site uses 100). |
cursor | opaque | From next_cursor; bound to the same filters and snapshot clock. |
as_of | ISO 8601 | Freeze the clock explicitly; later inserts are excluded. |
curl -s 'https://hippiekiller.net/api/items?window=7d&kev=1&limit=20' | jq '.items[] | {rank, title, cves, kev_due_date}'
Response: { count, total, items[], categories[], next_cursor, as_of }. Each item carries id, title, canonical_url, source_id, source_name, source_type, published_at, category, label, summary, vendors[], products[], cves[], cwes[], exposure[], cvss, cvss_vector, cvss_version, epss, epss_percentile, kev_status, kev_date_added, kev_due_date, kev_ransomware, ssvc_exploitation, ssvc_automatable, ssvc_impact, exploitation_status, patch_available, priority_score, rank, tier, priority_reasons[], cluster_id, nvd_status. total counts all matches, not the page.
GET /api/cve/{CVE-ID}
Aggregated view of one CVE: best CVSS, EPSS, KEV state, vendors, products, weaknesses, the list of sources that covered it, and every item in the archive that references it.
curl -s 'https://hippiekiller.net/api/cve/CVE-2026-114625' | jq '{cvss, epss, kev: .kev.kev_due_date, sources: [.sources[].source_name]}'
GET /api/item/{id}
One item with its related coverage (shared CVEs or cluster).
GET /api/sources
Every source with type, group, interval, last check, last success, last error, enabled state and item counts. Mirrors the sources page.
GET /api/stats
Archive totals, items per day for 14 days, KEV additions this week, the last ingestion run and the latest publication time. Poll this to detect new items cheaply.
Feeds
/feed.xml: RSS 2.0 of the wire (rank ≥ 20 or KEV, last 72 hours).?section=vulnerabilities|advisories|research|news|standardsnarrows it./today.txt: the briefing as plain text./sources.opml: every feed-backed source, importable into any reader./sitemap.xml: sections plus recent well-ranked items.
Conventions
- Times are ISO 8601 UTC.
as_ofis the snapshot clock the ranks were computed against. - Ranking is deterministic and documented on the about page;
priority_reasonslists every contribution. - Errors are JSON
{ "error": "..." }with status 400 for bad parameters and 404 for unknown ids. - This is a live feed, not a snapshot export: updates to existing records can reorder results between pages, inserts after
as_ofcannot.