Official public data, cleaned up and served by API.

Vulnerability feeds, sanctions lists, recall notices and company registers are free to download and awkward to use. We collect them from the source, check them every night and return them as consistent JSON, on one key and one credit balance.

Our first API, CVE Triage, is in development. Early access is open.

Request early access View the APIs

Request

curl https://api.stackbyte.app/v1/cve/CVE-2021-44228 \
  -H "X-API-Key: sb_live_..."

Response

{
  "data": {
    "cve_id": "CVE-2021-44228",
    "product": "Apache Log4j2",
    "cvss_v3": 10.0,
    "epss": 0.944,
    "known_exploited": true,
    "kev_date_added": "2021-12-10",
    "public_exploit": true
  },
  "meta": {
    "sources": ["NVD", "FIRST EPSS", "CISA KEV"],
    "data_as_of": "2026-09-23",
    "credits_charged": 1
  }
}

Example response. Field names may change before launch.

What we are building

Seven APIs, built in this order. Each one answers a specific question from sources you could check yourself.

CVE Triage

Is this vulnerability being exploited, and how likely is it to be?

Sources: NVD, FIRST EPSS, CISA KEV, OSV

In development

Package Risk

Is this npm, PyPI or Go package known to be vulnerable or malicious?

Sources: OSV, deps.dev, public malicious-package reports

Cloud Intel

Which provider, region and network does this IP address belong to? Is it a Tor exit?

Sources: Cloud provider IP range files, regional internet registries, Tor Project

Sanctions Screen

Does this name appear on a UN, UK, EU, US or UAE sanctions list?

Sources: UN, OFAC, EU, UK and UAE official lists

Planned

Product Recalls

Has this product been recalled in the UK, EU or US?

Sources: UK OPSS, EU Safety Gate, CPSC, FDA

Planned

UAE Company Verify

Is this UAE trade licence valid, and what is the company registered to do?

Sources: Dubai Pulse trade licence data, ADGM and DIFC public registers

Planned

Dubai Property Data

What have comparable Dubai properties sold and rented for?

Sources: Dubai Land Department via Dubai Pulse

Planned

Free to try with 100 credits a month. Paid plans start at $19 a month. See pricing

How we handle the data

Official sources only: Every dataset comes from a government register, an official API or a public feed whose licence allows commercial use. Each response names its sources.
Checked every night: Each import has to pass checks on structure and volume before it replaces the previous day's data. If a source is down or looks wrong, the API keeps serving the last good copy and tells you its date.
Lookups, not bulk downloads: The APIs answer questions about specific records. We do not sell copies of whole datasets.
As little personal data as possible: Where a record could identify a person, we keep only what a lookup needs and act on removal requests.

Mobile apps

We also build apps for iOS and Android. None are in the stores yet. If there is an app you wish existed, we would like to hear about it.

Suggest an app

Request early access

Leave your email and we will let you know when CVE Triage opens for testing, then again as each new API launches. Nothing else, and you can unsubscribe at any time.