List Entries
/api/v1/feedEntries, newest first (seq descending), with the feed-wide summary. Filters combine with AND. Boolean filters take lowercase true or false and ignore anything else. Text values are cut at 200 characters. To walk the whole feed, follow next_cursor: it is keyset on seq and stable while entries arrive. page is offset-based, so a page boundary can repeat or skip a row when entries arrive between requests.
Query Parameters
Case-insensitive substring of title, vendor, product, the first package's name or display_id.
Whether the entry has a check (check).
Whether the entry has a validated exploit (exploit).
Whether the entry has a KEV listing (signals.kev).
Whether the entry has a public PoC (signals.public_poc).
anchored: cve.org has published the CVE record. awaiting_cve: not yet. Other values match nothing.
"anchored" | "awaiting_cve"Exact status. Any other value matches nothing.
"published" | "in_pipeline" | "triaged_in_scope" | "rejected_out_of_scope" | "retired"Exact automation. Any other value matches nothing.
"deterministic" | "contextual"Case-insensitive substring of vendor.
Case-insensitive substring of product.
Case-insensitive substring of the first package's package_name.
Exact, case-sensitive match on the first package's ecosystem, e.g. npm, go, pip. Spellings are not normalised.
Entries whose published_at is within the last N days. 0 or less applies no filter, the same as omitting it; values above 3650 count as 3650; anything but the digits 0-9 is ignored.
0 <= value <= 3650Page size. Values outside 1 to 100 are clamped; a non-integer gives 25.
251 <= value <= 100Numbered page, from 1. A non-integer gives 1. Ignored when cursor is set.
11 <= value <= 1000000A next_cursor value. Returns the rows after it (lower seq). Ignored unless all digits 0-9.
^[0-9]+$Response Body
application/json
application/json
curl -X GET "https://zero.ethiack.com/api/v1/feed?check=true&anchor_state=awaiting_cve&limit=1"{
"entries": [
{
"affected": [
{
"affected_notes": [],
"affected_ranges": [
">= v3.2.0, <= v3.7.14"
],
"ecosystem": "go",
"fixed_versions": [
"v3.7.15"
],
"package_name": "Traefik",
"purl": "pkg:golang/Traefik"
}
],
"anchor_state": "awaiting_cve",
"automation": "deterministic",
"check": true,
"check_claim": {
"confidence_basis": "differential",
"evidence": "inferred",
"label": "version inference"
},
"check_confidence_basis": "differential",
"cve_id": null,
"cvelist_commit_at": null,
"cvelist_commit_sha": null,
"cvss_score": 8.2,
"cvss_src": "cna_vendor",
"cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"cvss_version": "4.0",
"cwes": [
567
],
"delta_is_lower_bound": true,
"details_pending": false,
"display_id": "ETK-2026-1908",
"epss_asof": null,
"epss_percentile": null,
"epss_score": null,
"etk_id": "ETK-2026-1908",
"euvd_id": null,
"exploit": false,
"first_run_started_at": "2026-10-17T21:16:46.536025+00:00",
"ghsa_id": "GHSA-ww7c-q3mv-xx22",
"had_prior_signal": true,
"last_run_finished_at": "2026-10-17T21:35:19.403927+00:00",
"last_run_started_at": "2026-10-17T21:16:46.536025+00:00",
"logo_key": "gh:traefik:traefik",
"mitigation": "Upgrade Traefik to v3.7.15 or later. Disable experimental FastProxy until the upgrade is complete; upgrade v3.2 through v3.6 deployments to a patched v3.7 release.",
"pipeline_minutes": 18.547798366666665,
"product": "go:Traefik",
"published_at": "2026-10-17T21:16:40.533963+00:00",
"seq": 1939,
"signals": {
"check": {
"at": "2026-10-17T21:35:19.403927+00:00",
"days": -0.16348727825231482,
"is_lower_bound": true,
"measured_at": "2026-10-18T01:30:44.732341+00:00",
"url": null
},
"trigger_signal": {
"at": "2026-10-16T08:00:59+00:00",
"days": -1.7290012125925927,
"is_lower_bound": true,
"measured_at": "2026-10-18T01:30:44.732341+00:00",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-ww7c-q3mv-xx22"
}
},
"status": "published",
"summary": "Traefik deployments with experimental FastProxy enabled are affected by a connection-handling flaw during backend protocol upgrades. An unauthenticated client can cause the Traefik process to terminate, resulting in denial of service; deployments without experimental FastProxy enabled are not affected.",
"superseded_by_etk_id": null,
"t0_at": null,
"title": "Unauthenticated denial of service in Traefik FastProxy",
"updated_at": "2026-10-18T01:05:38.668035+00:00",
"vendor": "go",
"withdrawal_reason": null,
"withdrawn_at": null
}
],
"next": "/api/v1/feed?check=true&anchor_state=awaiting_cve&limit=1&page=2",
"next_cursor": "1939",
"page": 1,
"pages": 51,
"prev": null,
"summary": {
"anchored": 1704,
"awaiting_cve": 155,
"contextual": 1096,
"deterministic": 760,
"entries": 1859,
"feed_rows": 1870,
"in_pipeline": 4,
"median_check_delta_days": 0.22095655906828704,
"median_exploit_delta_days": 0.15951611630787038,
"median_first_artifact_days": 0.22095655906828704,
"median_minutes_to_artifact": 396.36639615,
"median_minutes_to_start": 175.75760651666667,
"median_sample_size": 1704,
"no_prior_signal": 1567,
"watermark": "2026-10-18T01:30:28.814611+00:00",
"with_check": 809,
"with_exploit": 28
},
"total": 51
}{
"error": "internal"
}Get Logo GET
The product logo for an entry's `logo_key`. Raster images only.
List Marks GET
Each matching entry's position on the timeline in days from t = 0, with counts over the whole set. Takes the `GET /api/v1/feed` filters. Past 1500 marks the list is a stable sample, in-flight entries first, and `sampled` is `true`; the counts stay exact. Marks are not in date order.