Library and CVE audit APIs, plus advisories from Opera, Brave and Vivaldi

Released May 31, 2026

The library audit API checks up to 2,500 packages per request, identified by Package URL, from any mix of ecosystems. A CVE audit endpoint answers the opposite question: which packages a given CVE affects.

Library audit by PURL

Send PURLs from npm, PyPI, Maven, Debian and the other supported registries to POST /api/v4/audit/library. For each vulnerable package you get its matching advisories, the version range that matched and the latest known fixed version, with the packages that have the most advisories first. A malformed PURL doesn’t fail the request; it comes back in errors under its position in your list.

curl -XPOST https://vulners.com/api/v4/audit/library \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"packages": [
           "pkg:npm/[email protected]",
           "pkg:pypi/[email protected]",
           "pkg:maven/org.apache.logging.log4j/[email protected]"
         ]}'

Docs: Library audit

CVE audit

Give POST /api/v4/audit/cve a CVE ID and it returns the packages that CVE affects, each with its registry and vulnerable version range, and for OS packages the distribution scope, such as debian-11.

curl -XPOST https://vulners.com/api/v4/audit/cve \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"cve": "CVE-2021-44228"}'

Docs: CVE audit

What can be queried

GET /api/v4/search/collections lists every collection with a short description, its record count and when it was last updated. An integration or an AI agent can call it to see what Vulners holds.

Docs: Collections

New sources

Opera and Vivaldi security advisories, the security entries in Brave’s desktop and Android release notes, and Anthropic’s coordinated vulnerability disclosures from red.anthropic.com are collected as new sources.