Batch CVE audit and advisories from Kubernetes, HashiCorp and Grafana

Released June 30, 2026

Batch CVE audit turns a scanner’s list of up to 500 CVEs into affected packages and products in one request. Kubernetes, HashiCorp, Grafana, Jenkins, Spring and curl advisories are collected from each project’s own feed or site.

Batch CVE audit

POST /api/v4/audit/cves accepts up to 500 CVE IDs and returns one result per CVE, in the same shape as the single-CVE call. Both calls also return the affected CPE configurations, built from vendor advisories and CVE records, next to the affected packages.

curl -XPOST https://vulners.com/api/v4/audit/cves \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"cve": ["CVE-2026-42945", "CVE-2021-44228"]}'

Docs: Batch CVE audit

Six new sources

Each of these projects publishes its own security advisories, and Vulners collects them at the source: Kubernetes from its official CVE feed, curl from its vulnerability JSON, Jenkins from the jenkins.io repository, HashiCorp from its HCSEC announcements, plus the Grafana Labs and Spring advisories.

API reference

The OpenAPI spec behind docs.vulners.com covers the v4 subscription endpoints (list, get, create, update, delete) and the archive family and collection-state endpoints. They can be tried in Swagger or browsed in Redoc.