Data API & RSS feeds
Everything on this site is built from plain static files that anyone can use for free: no key, no sign-up, CORS enabled. They're rebuilt every few hours, so checking more than once an hour just returns the same data — an hourly check is plenty. The generated timestamp in each file tells you when it last changed.
RSS feeds
Add these to any feed reader, or to Slack/Teams with their RSS apps.
| feeds/latest.xml | All news (no bulk advisories) |
| feeds/top.xml | Stories covered by 3+ outlets |
| feeds/zeroday.xml | Zero-days & actively exploited |
| feeds/kev.xml | New CISA KEV entries |
| feeds/breach.xml | Data breaches |
| feeds/apt.xml | APT & nation-state activity |
| feeds/ransomware.xml | Ransomware news |
| feeds/supply-chain.xml | Supply-chain attacks |
| feeds/research.xml | Threat research reports |
| feeds/advisories.xml | Vendor & government advisories |
feeds/vendor-<name>.xml | Per vendor, e.g. vendor-fortinet.xml (links on each vendor page) |
feeds/actor-<name>.xml | Per threat actor, e.g. actor-apt28.xml |
JSON files
| File | Contents |
|---|---|
| data/news.json | stories[]: 30 days of merged stories. Keys: id, t title, u link, s source, c category, d published (ms), f first seen, x summary, tg tags, cv CVEs, ac actors, ve vendors, at ATT&CK IDs, mw malware, io IOC count, ai AI note, r other outlets [source, title, link, date], b bulk advisory, so social post |
| data/cves.json | kev latest KEV entries, kevIndex every KEV CVE → date added, info CVSS/description by CVE, epss [probability, percentile], poc public exploit repos, recent CVEs published in the last 4 days |
| data/iocs.json | IOCs per story id: h hashes, ip, d domains, u URLs, src report link |
| data/ransomware.json | 30-day claim counts by group / country / sector, per-day totals, latest 300 claims (unverified) |
| data/breaches.json | Newest breaches loaded into Have I Been Pwned |
| data/supply.json | Latest malicious-package advisories (GitHub Advisory Database) |
| data/sources.json | Every source with feed health |
| data/meta.json | Vendor, actor, ransomware-group and malware name lists |
Example: exploited CVEs for a vendor
const { kev } = await (await fetch('data/cves.json')).json();
console.log(kev.filter(k => k.v === 'Fortinet'));
Upstream data belongs to its publishers: CISA (KEV), NIST NVD, MITRE CVE, FIRST (EPSS), nomi-sec/PoC-in-GitHub, ransomware.live, Have I Been Pwned, GitHub Advisory Database and each news source. Headlines link to the original articles.