Every dataset, as JSON
Everything this site draws is available as plain JSON, served exactly as the pages use it, with open CORS so any page or script can read it. No key, no sign-up.
Endpoints
Start with the index. It lists every dataset with what it holds, how many records it has, how often it updates and where its numbers come from.
curl https://vulnerabilitydata.io/api/v1/index.json| Endpoint | What it holds | Records | Updates |
|---|---|---|---|
/api/v1/index.json | The list of every dataset below, with provenance. | 19 | every build |
/api/v1/ai-discovery.json | Vulnerabilities found with AI and reported by defenders, with the counter-evidence against reading them as a trend. | 11 | when a new case or study is published |
/api/v1/ai-incidents.json | The ledger: every documented incident where AI was involved, with tool class, attack stage, outcome reached and evidence grade, each quoted from a primary document. | 33 | when a primary document is added |
/api/v1/attacker-trends.json | Zero-days exploited in the wild, time to exploit, and Google's 2026 exploitation counts, as each publisher states them. | 6 | when the publisher ships a new edition |
/api/v1/breaches.json | Annual breach series from ITRC, Verizon DBIR and IBM, each kept as its source reported it. | 11 | when the publisher ships a new edition |
/api/v1/conjectures.json | Standing conjectures, each with its refutation condition, computed status and status history. | 9 | weekly |
/api/v1/cve-macro.json | Annual CVE totals, the NVD backlog and the growth in CVE numbering authorities. | 11 | annually, plus NVD notices |
/api/v1/cwe-types.json | Weakness-type rankings and their trends. | 5 | annually |
/api/v1/defender-capacity.json | Quoted reports of incident-response firms at capacity and of security teams unable to triage their alerts, with counter-evidence. Each row says who said it, whether its source ties the strain to AI, and whether the source sells a remedy. Collected reports, not a measurement. | 10 | when a new report is found |
/api/v1/hypotheses.json | Outcome hypotheses about AI, each with what AI predicts, the best non-AI rival, its falsifier, its series and a fixed evaluation date. | 7 | when a hypothesis is registered or revised |
/api/v1/instrument-changes.json | Dated changes in how a source counts, so a change in counting is never read as an effect of AI. | 21 | when a source changes how it counts |
/api/v1/live-ai-credited-cves.json | CVEs per month whose record credits an AI tool on a published, versioned list. A floor, never a share. | 33 | weekly |
/api/v1/live-breaches.json | Monthly breach counts from six separate populations (SEC filings, leak sites, Have I Been Pwned, California AG notices, HHS OCR reports), never summed. | 6 | weekly |
/api/v1/live-ca-ag.json | Monthly breach notices filed with the California Attorney General. | 178 | weekly |
/api/v1/live-cve-mix.json | CVEs per month by the numbering authority that published them, with each authority's severity scores and counts for a versioned list of weakness classes. | 33 | weekly |
/api/v1/live-hhs-ocr.json | Monthly HIPAA breach reports to the HHS Office for Civil Rights. | 205 | weekly |
/api/v1/live-sec-8k.json | SEC 8-K cybersecurity filings under Items 1.05 and 8.01, with the incident dates each filing states. | 35 | weekly |
/api/v1/live-tte.json | Time to exploit: days from a CVE's publication to its CISA KEV listing, by month. | 60 | weekly |
/api/v1/outcome-reports.json | Outcome figures from nine report families (losses, ransom paid, insurance claims, attacker speed, dwell time), one row per edition and metric with its quote. | 466 | when the publisher ships a new edition |
/api/v1/patch-tuesday.json | Microsoft Patch Tuesday CVE counts by month since 2018. | 106 | monthly |
Example: each hypothesis with its falsifier and evaluation date.
curl -s https://vulnerabilitydata.io/api/v1/hypotheses.json | jq '.hypotheses[] | {title, falsifier, evaluate_on}'Rules the data keeps
- Breach populations are separate series and are never summed.
- An AI tag that depends on a victim noticing AI is a floor, never a share.
- No figure is interpolated: a period with no reliable source is a gap.
- Every figure carries its own source, or is listed in its file's gaps as not yet verified against one. The files are served exactly as the site uses them.
Breach series count different populations, so they are never summed into one total. Read each file's own notes before comparing across files.
Limits and errors
Each IP address may make 120 requests every 60 seconds. Every answer says where you stand in RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy; past the limit the answer is 429 with Retry-After. A path that is not a dataset answers a JSON 404 that points back to the index. Rate limits → · llms.txt →
From the command line
The vulnerabilitydata command reads the same files and is built for agents: piped output is JSON only, errors go to stderr as JSON, and the exit codes are fixed. The install script checks the download's SHA-256 before it installs anything.
curl -fsSL https://vulnerabilitydata.io/cli/install.sh | sh
vulnerabilitydata datasets
vulnerabilitydata help --jsonEvery command, flag and exit code: CLI →
Licence and reproducing it
The compilation is MIT-licensed, like the Substrate repository it is published from. Each upstream source keeps its own terms. The collectors that fetch every live series, and the curated files, are published in the Substrate dataset, so anyone can rerun the numbers.