APITube Documentation
Sign inGet started

Cyber Security API quickstart ​

Fetch security news, read vulnerability details and add filters in five steps. The examples use /v1/cyber-security/news and show how to keep articles about actively exploited vulnerabilities.

Before you start ​

Sign up and copy your key from the APITube dashboard. The Free plan is enough for this guide. Send your key in X-API-Key, or use the api_key URL parameter for a browser test. See Authentication for other options.

Step 1: Fetch the latest cyber security news ​

Call the endpoint without filters. It returns the newest articles from the cyber crime and cyber warfare categories. fl limits each article to the fields you need, which keeps the response short.

bash
curl "https://api.apitube.io/v1/cyber-security/news?per_page=5&fl=id,title,published_at,href,cyber" \
  -H "X-API-Key: YOUR_API_KEY"
python
import requests

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={"per_page": 5, "fl": "id,title,published_at,href,cyber"},
    headers={"X-API-Key": "YOUR_API_KEY"},
)

for article in response.json()["results"]:
    print(article["published_at"], article["title"], article["cyber"]["cves"])
javascript
const params = new URLSearchParams({ per_page: '5', fl: 'id,title,published_at,href,cyber' });

const response = await fetch(`https://api.apitube.io/v1/cyber-security/news?${params}`, {
  headers: { 'X-API-Key': 'YOUR_API_KEY' }
});
const data = await response.json();

for (const article of data.results) {
  console.log(article.published_at, article.title, article.cyber.cves);
}

Step 2: Read the response ​

The response lists articles in results, with page links in next_page and previous_page. This example shows one article with a shortened cves list:

json
{
  "status": "ok",
  "limit": 5,
  "page": 1,
  "has_next_pages": true,
  "results": [
    {
      "id": 3015748420,
      "title": "Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More",
      "published_at": "2025-12-22T12:12:29.000Z",
      "href": "https://thehackernews.com/2025/12/weekly-recap-firewall-exploits-ai-data.html",
      "cyber": {
        "type": ["crime", "warfare"],
        "cves": ["CVE-2025-20393", "CVE-2025-40602", "CVE-2025-23006", "CVE-2025-14733"],
        "vendors": ["Cisco", "SonicWall", "WatchGuard", "Hewlett Packard Enterprise (HPE)", "ASUS"],
        "in_kev": true,
        "exploited": true,
        "cvss": 9.8
      }
    }
  ]
}

What the cyber block tells you about this article:

  • type — the article is in both cyber categories, crime and warfare.
  • cves — the CVE IDs mentioned in the title, description or body, in the order they first appear.
  • in_kev and exploited — at least one of those CVEs is in the CISA Known Exploited Vulnerabilities catalog.
  • vendors — the vendors of the CVEs that are in the KEV catalog.
  • cvss — the highest CVSS score written in the article, here 9.8.

Every field is described in Response format.

Step 3: Narrow the feed ​

Pick one cyber category with cyber.type, then add any News API filter. This request returns English cyber crime articles published since a given date, newest first:

bash
curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&language.code=en&published_at.start=2026-10-01&sort.by=published_at&sort.order=desc&per_page=10&fl=id,title,href,cyber" \
  -H "X-API-Key: YOUR_API_KEY"

cyber.type takes one value: crime or warfare. Leave it out to get both. The other filters you can combine with it are listed in Filters.

Step 4: Keep only exploited vulnerabilities ​

You cannot use cyber.in_kev or cyber.cvss as API filters. Check these fields in your code after receiving the response. This script collects CVEs from articles with at least one actively exploited vulnerability:

python
import requests

response = requests.get(
    "https://api.apitube.io/v1/cyber-security/news",
    params={
        "cyber.type": "crime",
        "language.code": "en",
        "per_page": 50,
        "fl": "id,title,href,published_at,cyber",
    },
    headers={"X-API-Key": "YOUR_API_KEY"},
)

for article in response.json()["results"]:
    cyber = article["cyber"]

    if cyber["in_kev"]:
        score = cyber["cvss"] if cyber["cvss"] is not None else "n/a"
        print(f"{article['published_at']}  CVSS {score}  {', '.join(cyber['vendors'])}")
        print(f"  {article['title']}")
        print(f"  {', '.join(cyber['cves'])}")

Treat in_kev: null as unknown. It means the KEV catalog was unavailable, so it does not tell you whether the vulnerability has been exploited.

Step 5: Page through results and export ​

When has_next_pages is true, request the URL in next_page. It keeps all your filters, including cyber.type. A page may contain fewer articles than per_page; continue until has_next_pages is false.

On paid plans the same request can return a file. Add export=csv (or tsv, xlsx, xml, rss, jsonl, parquet); the cyber block is written to a Cyber column in tabular formats:

bash
curl "https://api.apitube.io/v1/cyber-security/news?cyber.type=crime&language.code=en&per_page=100&export=csv" \
  -H "X-API-Key: YOUR_API_KEY" -o cyber-news.csv

Common errors ​

CodeStatusWhat went wrong
ER0900400cyber.type is not crime or warfare — for example ransomware, CRIME or crime,warfare
ER0179400cyber.type (or another parameter) appears twice in the URL
ER0171400per_page is above your plan's limit (10 on Free)
ER0706403Export or prompt used on a plan that does not include it

The full list is on the API reference page.

Next steps ​

  • Filters — every way to narrow the feed.
  • Use cases — alert feeds, vendor watch and daily digests built on this endpoint.
  • Response format — what CVE IDs, KEV status and CVSS scores mean.