API Reference

List Top CVEs by Honeypot Activity

Return the top CVEs ranked by Shadowserver honeypot connection volume over a configurable look-back window, so you can spot which vulnerabilities are being actively probed at scale right now.

GET

/v1/shadowserver/top-cves

Cost: 1 credit per successful call

Query parameters

daysintegeroptionaldefault: 30

Look-back window in days. Accepted range: 7–90.

limitintegeroptionaldefault: 50

Maximum number of CVEs to return. Accepted range: 1–100.

Request

curl "https://api.precursorintelligence.com/functions/v1/shadowserver/top-cves?days=14&limit=20" \
  -H "Authorization: Bearer $PRECURSOR_API_KEY"

Response

200 OK

{
  "data": {
    "count": 20,
    "days": 14,
    "limit": 20,
    "sort_column": "connections_7d",
    "items": [
      {
        "cve_id": "CVE-2024-3094",
        "vendor": "xz",
        "product": "xz-utils",
        "severity": "critical",
        "cvss": 10.0,
        "epss_score": 0.9741,
        "cisa_kev": true,
        "iot": false,
        "vulnerability_class": "supply-chain",
        "connections_7d": 218412,
        "connections_30d": 874103,
        "connections_90d": 2104981,
        "connections_total": 3198476,
        "action_priority": 1,
        "nvd_published": "2024-03-29",
        "summary_as_of": "2026-05-28"
      },
      {
        "cve_id": "CVE-2023-44487",
        "vendor": "apache",
        "product": "tomcat",
        "severity": "high",
        "cvss": 7.5,
        "epss_score": 0.8823,
        "cisa_kev": true,
        "iot": false,
        "vulnerability_class": "denial-of-service",
        "connections_7d": 104837,
        "connections_30d": 412904,
        "connections_90d": 1021433,
        "connections_total": 2108745,
        "action_priority": 2,
        "nvd_published": "2023-10-10",
        "summary_as_of": "2026-05-28"
      }
    ],
    "generated_at": "2026-05-29T08:14:22.341Z"
  },
  "meta": {
    "request_id": "8b16efb8-9a6c-4ace-b817-11cbee626d08",
    "generated_at": "2026-05-18T10:24:31.118Z",
    "credits": { "charged": 1, "remaining": 9998 }
  }
}

Response fields

data.countintegeroptional

Number of items returned (equals items.length).

data.daysintegeroptional

The look-back window used for this query, in days.

data.limitintegeroptional

The maximum row count applied to this query.

data.sort_columnstringoptional

The connection-count column used to rank results: connections_7d, connections_30d, or connections_90d, depending on the days value.

data.itemsarrayoptional

CVE records ranked by connection volume, highest first. Each item contains the fields below.

data.items[].cve_idstringoptional

CVE identifier (for example, CVE-2024-3094).

data.items[].vendorstringoptional

Vendor name associated with the CVE.

data.items[].productstringoptional

Product name associated with the CVE.

data.items[].severitystringoptional

CVSS severity label: critical, high, medium, or low.

data.items[].cvssnumberoptional

CVSS base score (0.0–10.0).

data.items[].epss_scorenumberoptional

EPSS probability score (0.0–1.0).

data.items[].cisa_kevbooleanoptional

Whether the CVE appears in the CISA Known Exploited Vulnerabilities catalog.

data.items[].iotbooleanoptional

Whether the CVE is associated with IoT devices.

data.items[].vulnerability_classstringoptional

Vulnerability class or category (for example, rce, denial-of-service).

data.items[].connections_7dintegeroptional

Total honeypot connections observed in the last 7 days.

data.items[].connections_30dintegeroptional

Total honeypot connections observed in the last 30 days.

data.items[].connections_90dintegeroptional

Total honeypot connections observed in the last 90 days.

data.items[].connections_totalintegeroptional

Total honeypot connections observed across all time.

data.items[].action_priorityintegeroptional

Remediation priority ranking assigned to this CVE.

data.items[].nvd_publishedstringoptional

Date the CVE was published in NVD (ISO 8601 date).

data.items[].summary_as_ofstringoptional

Date through which the summary data was last computed (ISO 8601 date).

data.generated_atstringoptional

ISO 8601 timestamp indicating when the response was produced.

Errors

Status	`error`	When
400	`invalid_days`, `invalid_limit`	A query parameter failed validation.
401	`invalid_authorization`	Missing or malformed `Authorization` header.
401	`unauthorized`	Invalid/revoked key, or IP not allowlisted.
402	`insufficient_credits`	Organisation credit balance is below 1.
404	`not_found`	The route or entity does not exist.
405	`method_not_allowed`	Only `GET` and `OPTIONS` are accepted.
500	`internal`	Unexpected server error (credit auto-refunded).

See Errors for the full error reference.