Audit¶

The Audit page describes Vulners’ host- and software-auditing APIs — fast, CPE-aware endpoints to convert installed software, OS versions and KB lists into actionable vulnerability intelligence: matched advisories, CVE lists, remediation commands and prioritized patch recommendations.

Open interactive specs

Open Redoc (interactive) Open Swagger (interactive)

Python SDK v4

Python examples use the v4 sync client: from vulners import Vulners, then v = Vulners(api_key="YOUR_API_KEY_HERE"). Every method shown has an identical awaitable mirror on AsyncVulners (await v.audit.software(...)). Audit methods return plain JSON-ready dicts and lists — the Response tabs show the raw HTTP payload. See the Python SDK page for details.

Enrichment¶

Every audit endpoint answers with advisories. How much each advisory says about itself is up to the request.

Asking for it¶

Two spellings mean the same thing, and every endpoint accepts both:

{"cvelistMetrics": true}
{"fields": ["cvelistMetrics"]}

Sending neither leaves the enrichment out. audit/sbom takes the file as its body, so it reads the same request from the query string: POST /api/v4/audit/sbom?cvelistMetrics=true.

Available values:

Value	What it adds to each advisory
`metrics`	`metrics.cvss` and `metrics.epss` — the highest severity across the advisory's CVEs
`exploitation`	`exploitation.wildExploited` and its sources (CISA KEV, VulnCheck KEV)
`cvelistMetrics`	one entry per CVE in the advisory — see below

What comes back per CVE¶

cvelistMetrics[] is the same shape on every endpoint, so one parser handles all of them:

{
  "cve": "CVE-2026-11645",
  "published": "2026-06-02T18:15:00",
  "cvss": {"score": 9.6, "severity": "CRITICAL", "version": "3.1", "vector": "CVSS:3.1/...", "source": "nvd"},
  "epss": [{"cve": "CVE-2026-11645", "epss": 0.00181, "percentile": 0.07874, "date": "2026-08-11"}],
  "exploitation": {"wildExploited": true, "wildExploitedSources": [{"type": "cisa_kev"}]},
  "ai_score": {"value": 6.6, "uncertainty": 0.4},
  "ssvc": {
    "id": "CVE-2026-11645",
    "role": "CISA Coordinator",
    "version": "2.0.3",
    "timestamp": "2026-06-09T17:47:03.781475Z",
    "options": [
      {"Exploitation": "active"},
      {"Automatable": "no"},
      {"Technical Impact": "total"}
    ]
  }
}

Use ssvc to order a list of findings

CVSS alone rarely produces a queue — a single host can carry several hundred findings scoring 7 or above. ssvc is the CISA decision block, passed through verbatim from the CVE 5.x ADP record, and it grades every CVE where exploitation.wildExploited flags only the rare exploited handful.

The axis to sort on is Exploitation: active → poc → none. It is reported for effectively every CVE — on a Windows Server 2022 audit, 1 569 of 1 572 entries carried it, 36 of them active.

options is an array of single-key objects because that is how the upstream record is written. It is passed through unchanged rather than flattened, so there is exactly one representation of it.

ssvc is omitted, not null-filled, on CVEs that have no CISA decision. The same holds for cvss and ai_score.

Knowing what the server honoured¶

An option an endpoint cannot act on is accepted and ignored rather than rejected, so it does not break callers that have been sending it. To make that visible, the response says what was applied:

"appliedOptions": ["metrics", "cvelistMetrics"],
"warnings": [
  {"option": "exploits", "message": "not supported on this endpoint; supported options: cvelistMetrics, metrics"}
]

audit/linux, audit/library and audit/sbom carry both fields in the response body. audit/software and audit/host answer with a bare array and report the same thing in headers instead:

X-Vulners-Applied-Options: title,metrics,cvelistMetrics
X-Vulners-Warnings: exploits: not supported on this endpoint

audit/smart and audit/kb reject an unknown option outright with 400, naming it and listing the accepted ones, so there is nothing to report after the fact.

Matching results to what you sent¶

Ordering differs per endpoint and is not something to rely on:

Endpoint	Order	Join on
`audit/linux`, `audit/library`, `audit/sbom`	worst first: advisory count, then package name	`package`
`audit/software`, `audit/host`	unspecified; inputs that matched nothing are absent	`input`
`audit/smart`	request order, one item per input string	`input`
`audit/kb`	one item per audited OS, advisories newest first	`package`

Matching by position is safe only on audit/smart. Everywhere else inputs can be dropped or reordered, and a positional match silently attributes one input's findings to another.

Software Audit API¶

Below are the audit endpoints which replace older burp endpoints.

Audit Multiple Software¶

Allows a batch submission of multiple software entries. Each entry can be provided either as a raw CPE string or as a CPE object (with the fields such as part, vendor, product, version, etc.). Additional attributes (like update, language, target_hw, etc.) may be included as needed.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`software`	body	array	yes	Array of software entries — either CPE objects (part/vendor/product/version/…) or raw CPE strings.
`match`	body	enum	no	partial (default) or full. full requires exact match for all provided fields.
`fields`	body	array	no	Which vulnerability fields to return (defaults: title, short_description, type, href, published, modified, ai_score)
`cvelistMetrics`	body	boolean	no	The other spelling of `fields: ["cvelistMetrics"]`. Folded into `fields` before the audit runs.
`catalog`	body	enum	no	CPE catalog to match against. `official` (default) — only NVD CVE Dictionary CPEs. `extended` — NVD + Vulners custom CPEs (see note below).

catalog: official vs extended

official — matches only CPEs published in the NVD CVE Dictionary. Strict and compatible with official CVE records; lowest false-positive rate.
extended — adds Vulners custom-built CPEs on top of the official set. Covers software, libraries, and versions that aren't represented in NVD (common for OS packages, JS/Python libs, niche vendors). Higher coverage, but may introduce false positives — use when NVD gaps matter more than strict precision.

Response schema:

The endpoint returns a JSON array with one entry per submitted software item:

Field	Type	Description
`input`	object	Echo of the submitted software entry.
`matched_criteria`	string	Canonical CPE 2.3 string the input resolved to.
`fixed_version`	string	Version to upgrade to so that none of the listed advisories still applies. `null` when no matched criterion bounds the affected range from above. Where an advisory names different fixed versions per platform, the highest is reported — the only answer that holds whatever the host runs.
`vulnerabilities`	array[object]	Matched vulnerabilities (see below). Empty if no matches.

Each item in vulnerabilities always carries id and reasons, plus any optional fields requested via fields.

reasons[] — why a vulnerability matched:

Field	Type	Description
`config`	string	Source of the match rule (e.g. `nvd`).
`criterias`	array[array]	OR-groups of AND-conditions. Outer array = OR, inner = AND.

Each inner criterion object:

Field	Type	Description
`criteria`	string	CPE 2.3 string the input matched against.
`vulnerable`	boolean	Whether this CPE is flagged as vulnerable.
`versionStartIncluding`	string	Lower bound, inclusive. Range-based rules only.
`versionStartExcluding`	string	Lower bound, exclusive. Range-based rules only.
`versionEndIncluding`	string	Upper bound, inclusive. Range-based rules only.
`versionEndExcluding`	string	Upper bound, exclusive. Range-based rules only.

Fields controlled by the fields parameter (returned only when listed in fields):

Field	Type	In defaults	Description
`title`	string	yes	Advisory title.
`short_description`	string	yes	One-line advisory summary.
`type`	string	yes	Advisory source type (e.g. `cve`, `nessus`, `osv`).
`href`	string	yes	URL to the advisory on vulners.com.
`published`	string	yes	ISO 8601 publication timestamp.
`modified`	string	yes	ISO 8601 last-modified timestamp.
`ai_score`	object	yes	AI-derived severity: `value`, `uncertainty` (both `0–10`).
`metrics`	object	no	CVSS/EPSS metrics (`cvss`, `cvss3`, `epss`, …).
`exploitation`	object	no	Wild exploitation: `wildExploited`, `wildExploitedSources`.
`cvelist`	array[string]	no	CVE IDs covered by the advisory.

Usage:

curl Python Response

Query:

POST /api/v4/audit/software

Example with software objects:

curl -X POST https://vulners.com/api/v4/audit/software -H "X-Api-Key: YOUR_API_KEY" -H "Content-Type: application/json" -d '{
    "software": [
        {
            "vendor": "ivanti",
            "product": "connect_secure",
            "version": "22.7",
            "update": "r2.4"
        },
        {
            "vendor": "sonicwall",
            "product": "SMA 200 firmware",
            "version": "10.2.1.5-34sv"
        }
    ],
    "match": "partial",
    "fields": ["title", "short_description"]
}'

Software

software (array of objects or strings): Each item is either:

An object, e.g.

{
  "part": "a",
  "vendor": "ivanti",
  "product": "connect_secure",
  "version": "22.7",
  "update": "r2.4"
}

A raw CPE string, e.g. cpe:2.3:a:ivanti:connect_secure:22.7:r2.4.

Additional attributes can also be included (e.g., update, language, target_hw) within the software objects; these are fully described in the CPE Usage in Vulners API section.

Example with raw CPE strings:

curl -X POST https://vulners.com/api/v4/audit/software -H "X-Api-Key: YOUR_API_KEY" -H "Content-Type: application/json" -d '{
    "software": [
        "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4",
        "cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.5-34sv"
    ],
    "match": "partial"
}'

Example with software objects:

v.audit.software(
    [
        {
            "part": "a",
            "vendor": "ivanti",
            "product": "connect_secure",
            "version": "22.7",
            "update": "r2.4"
        },
        {
            "vendor": "sonicwall",
            "product": "SMA 200 firmware",
            "version": "10.2.1.5-34sv"
        }
    ],
    fields=["title", "short_description"],
    match="partial"
)

Example with raw CPE strings:

v.audit.software(
    [
        "cpe:2.3:a:ivanti:connect_secure:22.3:sp1",
        "cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.5-34sv"
    ],
    fields=["title", "short_description"],
    match="partial"
)

{
  "input": {
    "part": "a",
    "vendor": "ivanti",
    "product": "connect_secure",
    "update": "r2.4",
    "version": "22.7"
  },
  "matched_criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
  "vulnerabilities": [
    {
      "id": "CVE-2025-0282",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
                "vulnerable": true
              }
            ]
          ]
        }
      ],
      "title": "CVE-2025-0282",
      "short_description": "Stack-based buffer overflow in Ivanti Connect Secure allows remote code execution by attackers."
    },
    {
      "id": "CVE-2025-0283",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
                "vulnerable": true
              }
            ]
          ]
        }
      ],
      "title": "CVE-2025-0283",
      "short_description": "Stack buffer overflow in Ivanti products allows local attackers to escalate privileges before updates."
    }
  ]
},
{
  "input": {
    "vendor": "sonicwall",
    "product": "SMA 200 firmware",
    "version": "10.2.1.5-34sv"
  },
  "matched_criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:10.2.1.5-34sv:*:*:*:*:*:*:*",
  "vulnerabilities": [
    {
      "id": "CVE-2022-2915",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
                "vulnerable": true,
                "versionEndIncluding": "10.2.1.5-34sv"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2022-2915",
      "short_description": "A Heap-based Buffer Overflow vulnerability in SonicWall SMA100 appliance allows remote authenticated attacker to cause Denial of Service"
    },
    {
      "id": "CVE-2023-44221",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
                "vulnerable": true,
                "versionEndIncluding": "10.2.1.9-57sv"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2023-44221",
      "short_description": "Improper neutralization of special elements in SMA100 SSL-VPN management interface allows remote authenticated attacker to inject arbitrary commands"
    },
    {
      "id": "CVE-2023-5970",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
                "vulnerable": true,
                "versionEndIncluding": "10.2.1.9-57sv"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2023-5970",
      "short_description": " Improper authentication in SMA100 SSL-VPN allows remote attacker to create identical external domain user using accent characters, resulting in MFA bypass"
    },
    {
      "id": "CVE-2024-22395",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*",
                "vulnerable": true,
                "versionEndExcluding": "10.2.1.11-65sv"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2024-22395",
      "short_description": "Improper access control in SMA100 SSL-VPN virtual office portal"
    }
  ]
}

Audit Host¶

This is a method for scanning multiple layers in one request. (There is no direct predecessor in older burp endpoints.)

Allows you to specify multiple software items plus additional filtering criteria that narrow down vulnerabilities to those relevant for a host environment. In this endpoint, the parameters operating_system, hardware, and application serve as filters and are not treated as software entries. At least one filter parameter (operating_system or application) is required.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`software`	body	array	yes	Array of software entries — either CPE objects (part/vendor/product/version/…) or raw CPE strings.
`operating_system`	body	object/string	conditional	OS filter (CPE or object). At least one of operating_system or application is required.
`application`	body	object/string	conditional	Application filter (e.g., WordPress) — used to limit results to application context.
`hardware`	body	object/string	no	Hardware/environment filter (CPE string or object). Use to narrow matches by target hardware/platform when applicable.
`match`	body	enum	no	partial (default) or full. full requires exact match for all provided fields.
`fields`	body	array	no	Which vulnerability fields to return (defaults: title, short_description, type, href, published, modified, ai_score)
`catalog`	body	enum	no	CPE catalog to match against: `official` (default, NVD only) or `extended` (NVD + Vulners custom CPEs). See catalog behavior under `/audit/software` for the trade-off.

Important

For Audit Host, it is required to include at least one filter parameter (operating_system or application). These filters ensure that vulnerabilities are returned only for the host environment (based on OS, hardware, and/or application) and not for all provided software entries.

Response shape

The response shape is identical to /audit/software — an array of { input, matched_criteria, vulnerabilities[] }. The same fields parameter controls which optional vulnerability fields (metrics, exploitation, cvelist, …) are included. See the Response schema block under /audit/software for the full breakdown of reasons[] and the fields-gated properties.

Example 1: Windows + .NET

Scenario: This scenario sets Windows 10/11 as the operating system, and .NET Framework 4.8 as installed software.

Usage:

curl Python Response

Query:

POST /api/v4/audit/host

Query example:

curl -X POST https://vulners.com/api/v4/audit/host \
     -H "Content-Type: application/json" \
     -H "X-Api-Key: YOUR_API_KEY" \
     -d '{
       "software": [ # (1)
         {
           "part": "a",
           "vendor": "microsoft",
           "product": ".net_framework",
           "version": "3.6"
         },
         {
           "part": "a",
           "vendor": "microsoft",
           "product": ".net_framework",
           "version": "4.8.1"
         }
       ],
       "operating_system": { # (2)
         "part": "o",
         "vendor": "microsoft",
         "product": "windows_server_2022_23h2"
       },
       "fields": ["title", "short_description"] # (3)
     }'

software (array of objects or strings): Each item is either:
- An object, e.g.
```
{
  "part": "a",
  "vendor": "ivanti",
  "product": "connect_secure",
  "version": "22.7",
  "update": "r2.4"
}
```
- A raw CPE string, e.g. cpe:2.3:a:ivanti:connect_secure:22.7:r2.4.
Additional attributes can also be included (e.g., update, language, target_hw) within the software objects; these are fully described in the CPE Usage in Vulners API section.
- operating_system (object | string): OS-level software. Could be cpe:2.3:o:microsoft:windows_10:21h2 or parted fields.
- application (object | string): Specifies a top-level application. This parameter is used as an additional filter and ensures that the returned vulnerabilities are not solely for software items. At least one of operating_system or application must be provided.
List of fields to retrieve for each vulnerability. If not specified, the default fields are used. Descriptions for specified fields can be found in default fields section.
- Defaults: "title", "short_description", "type", "href", "published", "modified", "ai_score"
- Available to include: "metrics", "exploitation", "cvelist".

v.audit.host(
    software=[
      {
        "part": "a",
        "vendor": "microsoft",
        "product": ".net_framework",
        "version": "3.6"
      },
      {
        "part": "a",
        "vendor": "microsoft",
        "product": ".net_framework",
        "version": "4.8.1"
      }
    ],
    operating_system={
      "part": "o",
      "vendor": "microsoft",
      "product": "windows_server_2022_23h2"
    },
    fields=[
      "title",
      "short_description"
    ],
    match="partial"
)

[
  {
    "input": {
      "part": "a",
      "vendor": "microsoft",
      "product": ".NET Framework",
      "version": "3.6"
    },
    "matched_criteria": "cpe:2.3:a:microsoft:.net_framework:3.6:*:*:*:*:*:*:*",
    "vulnerabilities": []
  },
  {
    "input": {
      "part": "a",
      "vendor": "microsoft",
      "product": ".net_framework",
      "version": "4.8.1"
    },
    "matched_criteria": "cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*",
    "vulnerabilities": [
      {
        "id": "CVE-2024-0056",
        "title": "CVE-2024-0056",
        "short_description": "CVE-2024-0056 Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass ..."
      },
      {
        "id": "CVE-2024-0057",
        "title": "CVE-2024-0057",
        "short_description": "NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability"
      },
      {
        "...": "... other vulnerabilities truncated ..."
      }
    ]
  }
]

Example 2: Linux + Curl/SSH

Scenario: This scenario sets Red Hat Enterprise Linux as the OS, plus two installed packages (curl and OpenSSH).

Usage:

curl Python Response

Query:

POST /api/v4/audit/host

Query example:

curl -X POST https://vulners.com/api/v4/audit/host -H "X-Api-Key: YOUR_API_KEY" -H 'Content-Type: application/json' -d '{
    "software": [
      {
          "part": "a",
          "vendor": "haxx",
          "product": "libcurl",
          "version": "8.8"
      },
      {
          "part": "a",
          "vendor": "openbsd",
          "product": "openssh",
          "version": "8.5"
      }
    ],
    "operating_system": {
      "part": "o",
      "vendor": "redhat",
      "product": "enterprise_linux",
      "version": "9.4"
    },
    "fields": [
      "title",
      "short_description"
    ],
    "match": "partial" # (1)
}'

- "partial" (default): Relaxed matching. For example, if update or target_hw is not specified, vulnerabilities can still match partial criteria.
- "full": Strict matching. All specified attributes must match exactly (including update, language, etc.). If any field (like target_hw) is missing in the vulnerability listing or in your request, it won’t match.

v.audit.host(
    software=[
      {
          "part": "a",
          "vendor": "haxx",
          "product": "libcurl",
          "version": "8.8"
      },
      {
          "part": "a",
          "vendor": "openbsd",
          "product": "openssh",
          "version": "8.5"
      }
    ],
    operating_system={
      "part": "o",
      "vendor": "redhat",
      "product": "enterprise_linux",
      "version": "9.4"
    },
    fields=[
      "title",
      "short_description"
    ],
    match="partial"
)

[
  {
    "input": {
      "part": "a",
      "vendor": "haxx",
      "product": "libcurl",
      "version": "8.8"
    },
    "matched_criteria": "cpe:2.3:a:haxx:libcurl:8.8:*:*:*:*:*:*:*",
    "vulnerabilities": [
      {
        "id": "CVE-2024-6874",
        "title": "CVE-2024-6874",
        "short_description": "CVE-2024-6874 macidn punycode buffer overread in libcurl url function"
      },
      {
        "id": "CVE-2024-7264",
        "title": "CVE-2024-7264",
        "short_description": "libcurl ASN1 parser `GTime2str()` function vulnerability"
      },
      {
        "...": "... other vulnerabilities truncated ..."
      }
    ]
  },
  {
    "input": {
      "part": "a",
      "vendor": "openbsd",
      "product": "openssh",
      "version": "8.5"
    },
    "matched_criteria": "cpe:2.3:a:openbsd:openssh:8.5:*:*:*:*:*:*:*",
    "vulnerabilities": [
      {
        "id": "CVE-2024-6387",
        "title": "CVE-2024-6387",
        "short_description": "Security regression in OpenSSH server (sshd). Race condition ..."
      },
      {
        "id": "CVE-2020-14145",
        "title": "CVE-2020-14145",
        "short_description": "The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy ..."
      },
      {
        "...": "... other vulnerabilities truncated ..."
      }
    ]
  }
]

Example 3: WordPress + Plugin

Scenario: This scenario sets WordPress as the application filter plus a Yoast SEO plugin as installed software.

Usage:

curl Python Response

Query:

POST /api/v4/audit/host

Query example:

curl -X POST https://vulners.com/api/v4/audit/host -H "X-Api-Key: YOUR_API_KEY" -H "Content-Type: application/json" -d '{
    "software": [
         {
           "part": "a",
           "vendor": "yoast",
           "product": "yoast seo",
           "version": "3.4"
         }
       ],
       "application": {
         "part": "a",
         "vendor": "wordpress",
         "product": "wordpress"
       },
       "fields": ["title", "short_description"]
}'

v.audit.host(
    software=[
      {
        "part": "a",
        "vendor": "yoast",
        "product": "yoast seo",
        "version": "20.4"
      }
    ],
    application= {
      "part": "a",
      "vendor": "wordpress",
      "product": "wordpress"
    },
    fields=[
      "title",
      "short_description"
    ],
    match="partial"
)

{
  "input": {
    "part": "a",
    "vendor": "yoast",
    "product": "yoast seo",
    "version": "20.4"
  },
  "matched_criteria": "cpe:2.3:a:yoast:yoast_seo:20.4:*:*:*:*:*:*:*",
  "vulnerabilities": [
    {
      "id": "PATCHSTACK:D15EC4814FA577180898B6C415B337D4",
      "reasons": [
        {
          "config": "vulners",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:typo3:*:*",
                "vulnerable": true,
                "versionEndIncluding": "20.4"
              }
            ]
          ]
        }
      ],
      "title": "WordPress Yoast SEO Premium Plugin <= 20.4 is vulnerable to Broken Access Control",
      "short_description": "WordPress Yoast SEO Premium Plugin <= 20.4 vulnerability: Broken Access Control"
    },
    {
      "id": "CVE-2023-40680",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:*",
                "vulnerable": true,
                "versionEndIncluding": "21.0"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2023-40680",
      "short_description": "CVE-2023-40680: Stored XSS in Team Yoast Yoast SEO"
    },
    {
      "id": "CVE-2023-28775",
      "reasons": [
        {
          "config": "nvd",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:*",
                "vulnerable": true,
                "versionEndExcluding": "20.5"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2023-28775",
      "short_description": "Yoast SEO Premium Missing Authorization Vulnerability"
    },
    {
      "id": "CVE-2024-4041",
      "reasons": [
        {
          "config": "vulners",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:*",
                "vulnerable": true,
                "versionEndIncluding": "22.5"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2024-4041",
      "short_description": "The Yoast SEO plugin for WordPress has Reflected Cross-Site Scripting vulnerability"
    },
    {
      "id": "CVE-2024-4984",
      "reasons": [
        {
          "config": "vulners",
          "criterias": [
            [
              {
                "criteria": "cpe:2.3:a:yoast:yoast_seo:*:*:*:*:*:wordpress:*:*",
                "vulnerable": true,
                "versionEndIncluding": "22.6"
              }
            ]
          ]
        }
      ],
      "title": "CVE-2024-4984",
      "short_description": "Yoast SEO plugin vulnerability allows injection of arbitrary web script"
    }
  ]
}

Example 4: WordPress + Plugin + Linux

Scenario: This scenario sets Debian Linux as operating_system, WordPress as application, and a popular plugin (Woocommerce Pre-Orders) as installed software.

Usage:

curl Python Response

Query:

POST /api/v4/audit/host

Query example:

curl -X POST https://vulners.com/api/v4/audit/host -H "X-Api-Key: YOUR_API_KEY" -H 'Content-Type: application/json' -d '{
    "software": [
      {
        "part": "a",
        "vendor": "woocommerce",
        "product": "woocommerce_pre-orders",
        "version": "2.0"
      }
    ],
    "operating_system": {
      "part": "o",
      "vendor": "debian",
      "product": "debian_linux",
      "version": "11"
    },
    "application": {
      "part": "a",
      "vendor": "wordpress",
      "product": "wordpress"
    },
    "fields": [
      "title",
      "short_description"
    ],
    "match": "partial"
}'

v.audit.host(
    software=[
      {
          "part": "a",
          "vendor": "woocommerce",
          "product": "woocommerce_pre-orders",
          "version": "2.0"
      }
    ],
    operating_system={
          "part": "o",
          "vendor": "debian",
          "product": "debian_linux",
          "version": "11"
    },
    application= {
        "part": "a",
        "vendor": "wordpress",
        "product": "wordpress"
    },
    fields=[
      "title",
      "short_description"
    ],
    match="partial"
)

[
  {
    "input": {
      "part": "a",
      "vendor": "woocommerce",
      "product": "woocommerce_pre-orders",
      "version": "2.0"
    },
    "matched_criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:2.0:*:*:*:*:*:*:*",
    "vulnerabilities": [
      {
        "id": "CVE-2023-32793",
        "reasons": [
          {
            "config": "nvd",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndIncluding": "2.0.0"
                }
              ]
            ]
          },
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndIncluding": "2.0.0"
                }
              ]
            ]
          }
        ],
        "title": "CVE-2023-32793",
        "short_description": "Auth. Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <=\u00a02.0.0 versions"
      },
      {
        "id": "PATCHSTACK:E2F81C0D4E183BAF40E850AA31186ED1",
        "reasons": [
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndIncluding": "2.0.0"
                }
              ]
            ]
          }
        ],
        "title": "WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)",
        "short_description": "WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 Cross-Site Scripting Vulnerability. Low Severit"
      },
      {
        "id": "CVE-2023-3507",
        "reasons": [
          {
            "config": "nvd",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          },
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          }
        ],
        "title": "CVE-2023-3507",
        "short_description": "The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-order"
      },
      {
        "id": "CVE-2023-3508",
        "reasons": [
          {
            "config": "nvd",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          },
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          }
        ],
        "title": "CVE-2023-3508",
        "short_description": " WooCommerce Pre-Orders WordPress plugin 2.0.3 CSRF vulnerability"
      },
      {
        "id": "WPVDB-ID:C431878C-8BCA-4688-9C6B-1C9E871A6A7B",
        "reasons": [
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.2"
                }
              ]
            ]
          }
        ],
        "title": "WooCommerce Pre-Orders < 2.0.2 - Reflected XSS",
        "short_description": "WooCommerce Pre-Orders plugin < 2.0.2 - Reflected XSS, unescaped URLs in attribute"
      },
      {
        "id": "WPVDB-ID:064C7ACB-DB57-4537-8A6D-32F7EA31C738",
        "reasons": [
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          }
        ],
        "title": "WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF",
        "short_description": "Flawed CSRF check in WooCommerce Pre-Orders < 2.0.3 allows unauthorized actions"
      },
      {
        "id": "WPVDB-ID:E72BBE9B-E51D-40AB-820D-404E0CB86EE6",
        "reasons": [
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.3"
                }
              ]
            ]
          }
        ],
        "title": "WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF",
        "short_description": "WooCommerce Pre-Orders < 2.0.3 flawed CSRF allows arbitrary pre-order canceling"
      },
      {
        "id": "WPVDB-ID:A86BDCFB-A1DB-4775-8F30-8EEC3F53A77A",
        "reasons": [
          {
            "config": "vulners",
            "criterias": [
              [
                {
                  "criteria": "cpe:2.3:a:woocommerce:woocommerce_pre\\-orders:*:*:*:*:*:wordpress:*:*",
                  "vulnerable": true,
                  "versionEndExcluding": "2.0.1"
                }
              ]
            ]
          }
        ],
        "title": "WooCommerce Pre-Orders < 2.0.1 - Contributor+ Stored XSS",
        "short_description": "WooCommerce Pre-Orders plugin vulnerability Stored XSS"
      }
    ]
  }
]

Deprecated Endpoints¶

Deprecated

The following endpoints remain operational for now but are slated for future removal:

POST /api/v3/burp/softwareapi/
POST /api/v3/burp/packages/

Use the new /api/v4/audit/ endpoints instead:

POST /api/v4/audit/software
POST /api/v4/audit/host

Package Audit API¶

The Package Audit API processes dependency lists from your project's package manager output and cross-references them against Vulners' vulnerability database. It identifies vulnerable packages, suggests fixed versions, and lists applicable advisories with version match ranges.

Supported package managers:

Manager	Endpoint	Input format	Example input source
Maven	`/api/v4/audit/package/maven`	Maven dependency list (text/plain)	`mvn dependency:list`
Pip	`/api/v4/audit/package/pip`	Pip freeze output (text/plain)	`pip freeze`
Poetry	`/api/v4/audit/package/poetry`	Poetry lock file content (text/plain)	`cat poetry.lock`
NPM	`/api/v4/audit/package/npm`	package-lock.json content (text/plain)	`cat package-lock.json`
Golang	`/api/v4/audit/package/golang`	Go modules list (text/plain)	`go list -m all`

Python SDK v4

Every package manager has a typed helper that uploads the manifest for you: v.audit.packages.maven(file), .pip(file), .poetry(file), .uv(file), .npm(file), .golang(file) — or the generic v.audit.packages.scan(ecosystem, file). file accepts a path, an open file object, or raw bytes; the include_* keyword flags mirror the query parameters below.

report = v.audit.packages.pip("requirements.txt")   # the SDK unwraps the `result` envelope
for issue in report["issues"]:
    print(issue["package"], issue["version"], "->", issue.get("fixedVersion"))

Response format:

All endpoints return a consistent JSON structure:

result.issues: Array of vulnerable packages
package: Package name
version: Current version
fixedVersion: Recommended safe version
scopes: Dependency scopes (e.g., "test", "main")
applicableAdvisories: Matching vulnerabilities with IDs and version ranges
result.totalPackages: Number of packages parsed from the input.

If no issues found, issues is an empty array.

Query parameters (all optional, applied identically to every package endpoint):

Name	Type	Default	Description
`includeAnyVersion`	boolean	`true`	Include advisories that match the package name regardless of version. Snake_case alias `include_any_version`.
`includeCandidates`	boolean	`false`	Include candidate advisories (those awaiting vendor confirmation).
`includeUnofficial`	boolean	`false`	Include advisories sourced from unofficial / third-party feeds.
`includeTransitives`	boolean	`false`	Include transitively-introduced packages in the audit.

Auth: X-Api-Key header required.

Maven audit¶

Usage:

curl Response

Query:

POST /api/v4/audit/package/maven

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/maven \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(mvn -B -q dependency:list -DoutputFile=/dev/stdout)"

{
    "result": {
        "issues": [
            {
                "package": "junit:junit",
                "version": "4.12",
                "fixedVersion": "4.13.1",
                "scopes": [
                    "test"
                ],
                "applicableAdvisories": [
                    {
                        "id": "OSV:GHSA-269G-PWP5-87PP",
                        "match": ">=4.7,<4.13.1"
                    }
                ]
            }
        ]
    }
}

Pip audit¶

Usage:

curl Response

Query:

POST /api/v4/audit/package/pip

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/pip \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(pip freeze)"

{
    "result": {
        "issues": [
            {
                "package": "notebook",
                "version": "4.2.0",
                "fixedVersion": "6.1.5",
                "scopes": [
                    "main"
                ],
                "applicableAdvisories": [
                    {
                        "id": "OSV:PYSEC-2018-17",
                        "match": ">=0,<5.7.1"
                    },
                    {
                        "id": "OSV:PYSEC-2018-18",
                        "match": ">=0,<5.7.2"
                    },
                    {
                        "id": "OSV:PYSEC-2020-215",
                        "match": ">=0,<6.1.5"
                    }
                ]
            }
        ]
    }
}

Poetry/uv audit¶

Usage:

curl Response

Query:

POST /api/v4/audit/package/poetry

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/poetry \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(cat poetry.lock)"

{
    "result": {
        "issues": [
            {
                "package": "notebook",
                "version": "4.2.0",
                "fixedVersion": "6.1.5",
                "scopes": [
                    "main"
                ],
                "applicableAdvisories": [
                    {
                        "id": "OSV:PYSEC-2018-17",
                        "match": ">=0,<5.7.1"
                    },
                    {
                        "id": "OSV:PYSEC-2018-18",
                        "match": ">=0,<5.7.2"
                    },
                    {
                        "id": "OSV:PYSEC-2020-215",
                        "match": ">=0,<6.1.5"
                    }
                ]
            }
        ]
    }
}

curl Response

Query:

POST /api/v4/audit/package/uv

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/uv \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(cat uv.lock)"

{
    "result": {
        "issues": [
            {
                "package": "notebook",
                "version": "4.2.0",
                "fixedVersion": "6.1.5",
                "scopes": [
                    "main"
                ],
                "applicableAdvisories": [
                    {
                        "id": "OSV:PYSEC-2018-17",
                        "match": ">=0,<5.7.1"
                    },
                    {
                        "id": "OSV:PYSEC-2018-18",
                        "match": ">=0,<5.7.2"
                    },
                    {
                        "id": "OSV:PYSEC-2020-215",
                        "match": ">=0,<6.1.5"
                    }
                ]
            }
        ]
    }
}

Npm audit¶

Usage:

curl Response

Query:

POST /api/v4/audit/package/npm

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/npm \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(cat package-lock.json)"

{
    "result": {
        "issues": [
            {
                "package": "@babel/helpers",
                "version": "7.26.0",
                "fixedVersion": "7.26.10",
                "scopes": [
                    "main"
                ],
                "applicableAdvisories": [
                    {
                        "id": "OSV:GHSA-968P-4WVH-CQC8",
                        "match": ">=0,<7.26.10"
                    }
                ]
            },
            {
                "package": "nuxt",
                "version": "3.15.2",
                "fixedVersion": "3.19.0",
                "scopes": [
                    "main"
                ],
                "applicableAdvisories": [
                    {
                        "id": "SNYK:JS-NUXT-12878602",
                        "match": ">=3.6.0,<3.19.0"
                    }
                ]
            }
        ]
    }
}

Golang audit¶

Usage:

curl Response

Query:

POST /api/v4/audit/package/golang

Example:

curl -XPOST https://vulners.com/api/v4/audit/package/golang \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(go list -m all)"

{
    "result": {
        "issues": [
        ]
    }
}

Library Audit¶

Audit packages identified by PURL (Package URL). Send a list of PURLs from any registry (pkg:npm/…, pkg:pypi/…, pkg:maven/…, pkg:deb/…, …); returns the vulnerable ones with fix versions and matching advisories. For raw lock-file input, use /audit/package/{ecosystem}.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`packages`	body	array[string]	yes	List of PURLs (e.g. `pkg:npm/[email protected]`, `pkg:pypi/[email protected]`). 1–2500 entries.
`include_unofficial`	body	boolean	no	Include packages from unofficial / community sources. Default `false`.
`include_candidates`	body	boolean	no	Include candidate (not-yet-confirmed) affected packages. Default `false`.
`include_any_version`	body	boolean	no	Include records that match any version (no specific range). Default `false`.
`cvelist_metrics`	body	boolean	no	Attach the per-CVE breakdown to each advisory. Available on every licence. Default `false`.
`fields`	body	array[string]	no	`metrics` and/or `cvelistMetrics`. Values this endpoint cannot answer are accepted and reported back in `warnings`.

Response schema:

Field	Type	Description
`result.issues`	array[object]	One entry per vulnerable input package. Sorted by advisory count (descending), then by package name.
`result.errors`	object	Parse errors, keyed by the input's 0-based index in `packages`. Empty `{}` when every PURL parsed.
`result.totalPackages`	integer	Count of PURLs that parsed successfully.
`result.appliedOptions`	array[string]	Options the server actually honoured.
`result.warnings`	array[object]	Options accepted and not acted on, each with `option` and `message`.

Each issues[] entry:

Field	Type	Always present	Description
`package`	string	yes	Echoes the input PURL.
`version`	string	—	Version from the input PURL. Omitted if the PURL didn't carry one.
`fixedVersion`	string	—	Latest known fix. Omitted if no fix is known.
`applicableAdvisories`	array[object]	yes	Matching advisories for this package/version.

Each applicableAdvisories[] entry. Optional fields (distro, arch, classifier, cvelistMetrics) are omitted when not applicable, not returned as null.

Field	Type	Always present	Description
`id`	string	yes	Advisory identifier (e.g. `OSV:GHSA-…`, `SNYK:…`, `DEBIANCVE:CVE-…`).
`match`	string	yes	Vulnerable version range that matched (e.g. `<4.17.21`, `>=4.2,<4.2.30`).
`registry`	string	yes	Registry the advisory targets (`npm`, `pypi`, `maven`, `deb`, `rpm`, …).
`distro`	array[string]	—	Distribution scope (e.g. `["debian", "debian-10"]`). Present only for OS-package registries.
`arch`	array[string]	—	Affected architectures. Present only on arch-specific advisories.
`classifier`	array[string]	—	Classifiers (e.g. Maven `classifier`). Present only when the advisory targets one.
`metrics`	object	—	Advisory-level rollup: `cvss` and `epss`, the highest across this advisory's CVEs. Present when requested via `fields`.
`exploitation`	object	—	`wildExploited` and its sources. Present when requested via `fields`.
`cvelistMetrics`	array[object]	—	One entry per CVE — `cvss`, `epss`, `exploitation`, `ai_score`, `ssvc`. See Enrichment for the full shape.

Usage:

curl Python Response Response (with errors) Response (OS-package)

Query:

POST /api/v4/audit/library

Single npm package:

curl -XPOST https://vulners.com/api/v4/audit/library \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"packages": ["pkg:npm/[email protected]"]}'

Multi-ecosystem:

curl -XPOST https://vulners.com/api/v4/audit/library \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"packages": [
           "pkg:npm/[email protected]",
           "pkg:pypi/[email protected]",
           "pkg:maven/org.apache.logging.log4j/[email protected]"
         ]}'

Mixed valid + invalid (populates errors):

curl -XPOST https://vulners.com/api/v4/audit/library \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"packages": [
           "pkg:npm/[email protected]",
           "not-a-purl",
           "pkg:pypi/",
           "pkg:npm/[email protected]"
         ]}'

Single npm package:

v.audit.library_audit(packages=["pkg:npm/[email protected]"])

Multi-ecosystem:

v.audit.library_audit(packages=[
    "pkg:npm/[email protected]",
    "pkg:pypi/[email protected]",
    "pkg:maven/org.apache.logging.log4j/[email protected]",
])

With unofficial / candidate / any-version records and CVE-list metrics (paid plans):

v.audit.library_audit(
    packages=["pkg:npm/[email protected]"],
    include_unofficial=True,
    include_candidates=True,
    include_any_version=True,
    cvelist_metrics=True,
)

{
  "result": {
    "issues": [
      {
        "package": "pkg:npm/[email protected]",
        "version": "4.16.0",
        "fixedVersion": "4.20.0",
        "applicableAdvisories": [
          { "id": "OSV:GHSA-RV95-896H-C2VC", "match": "<4.19.2", "registry": "npm" },
          { "id": "OSV:GHSA-QW6H-VGH9-J6WX", "match": "<4.20.0", "registry": "npm" }
        ]
      }
    ],
    "errors": {},
    "totalPackages": 1
  }
}

errors is keyed by the 0-based input index: "not-a-purl" failed at index 1, "pkg:pypi/" at index 2. Advisory lists trimmed here for brevity.

{
  "result": {
    "issues": [
      {
        "package": "pkg:npm/[email protected]",
        "version": "4.17.15",
        "fixedVersion": "4.18.1",
        "applicableAdvisories": [
          { "id": "SNYK:JS-LODASH-6139239", "match": "<4.17.17", "registry": "npm" },
          { "id": "OSV:GHSA-P6MC-M468-83GW", "match": ">=3.7.0,<4.17.19", "registry": "npm" },
          { "id": "OSV:GHSA-35JH-R3H4-6JHM", "match": "<4.17.21", "registry": "npm" }
        ]
      },
      {
        "package": "pkg:npm/[email protected]",
        "version": "4.16.0",
        "fixedVersion": "4.20.0",
        "applicableAdvisories": [
          { "id": "OSV:GHSA-RV95-896H-C2VC", "match": "<4.19.2", "registry": "npm" },
          { "id": "OSV:GHSA-QW6H-VGH9-J6WX", "match": "<4.20.0", "registry": "npm" }
        ]
      }
    ],
    "errors": {
      "1": "purl is missing the required \"pkg\" scheme component: 'not-a-purl'.",
      "2": "purl is missing the required name component: 'pkg:pypi/'"
    },
    "totalPackages": 2
  }
}

OS-package registries (deb, rpm, apk, alpm) add distro to each advisory, and arch when the advisory is arch-specific. Excerpt from pkg:deb/debian/[email protected]:

{
  "result": {
    "issues": [
      {
        "package": "pkg:deb/debian/[email protected]",
        "version": "7.64.0-4",
        "fixedVersion": "8.14.1-1",
        "applicableAdvisories": [
          {
            "id": "OSV:DSA-4633-1",
            "match": ">=7,<7.64.0-4+deb10u1",
            "registry": "deb",
            "distro": ["debian", "debian-10"]
          },
          {
            "id": "OSV:DEBIAN-CVE-2019-5482",
            "match": "<7.66.0-1",
            "registry": "deb",
            "distro": ["debian", "debian-11", "debian-12", "debian-13", "debian-14"]
          }
        ]
      }
    ],
    "errors": {},
    "totalPackages": 1
  }
}

Package Metadata¶

Look up what Vulners records about a single package version: the licence on it, and the version span that licence record covers. This is the only endpoint that answers with a package's licence — Library Audit takes the same packages as PURLs and the Package Audit API takes lock files, but both answer with vulnerabilities and fix versions instead.

Auth: X-Api-Key header required. Available on every plan — one wallet call per request, with none of the free-key restriction the archive endpoints apply.

Parameters:

Name	In	Type	Required	Description
`registry`	body	string	yes	Package registry, lower-case only — `PyPI` and `Maven` are not accepted. See the table below.
`name`	body	string	yes	Package name as its own registry writes it. Four registries expect a compound name — see below.
`version`	body	string	yes	Exact version to look up, in the registry's own form (`go` module versions keep their leading `v`).

Registries and name formats¶

A name shaped for the wrong registry is an error, not an empty answer — maven in particular uses a colon, unlike the slash the equivalent PURL uses.

Registry	Name format	Example
`pypi`, `npm`, `nuget`, `cargo`, `conan`, `gem`, `hex`, `pub`, `cocoapods`, `hackage`, `cran`, `deb`, `rpm`, `apk`	Plain package name; npm scopes as usual	`requests`, `@babel/core`
`go`	Full module path	`github.com/gin-gonic/gin`
`maven`	`groupId:artifactId` — colon, not a slash	`org.apache.logging.log4j:log4j-core`
`composer`	`vendor/package`	`guzzlehttp/psr7`
`swift`	`owner/repo`, optionally with the host	`github.com/apple/swift-nio`

Three aliases are accepted for the same registries: golang for go, rubygems for gem, and packagist for composer.

Response schema:

Field	Type	Description
`result.name`	string	Echoes the submitted name.
`result.version`	string	Echoes the submitted version.
`result.range`	string	Version span of the licence record that matched, rendered `>=<start>, <<end>`. Either bound may be absent, which shows as an empty side (`">=, <"`). Informational only — see below.
`result.license`	array[string]	Licences recorded for that span, as SPDX identifiers. Always an array, never a bare string.

license is an array because a package can carry several. One element may itself be an SPDX expression ("Apache-2.0 OR MIT"), and "non-standard" stands for a licence with no SPDX identifier.

range describes the licence record, not the package's release history: it is the span of versions that record covers. It is not a parseable constraint and is not guaranteed to contain the version you asked about — pypi/[email protected] answers ">=, <0.11.2". Read it as provenance for the licence, and don't feed it to a version comparator.

When there is no data¶

A package Vulners has no record of is not a 404. It comes back as a 200 with the name and version echoed and both data fields empty:

{"result": {"name": "guzzlehttp/psr7", "version": "2.7.1", "range": "", "license": []}}

So an empty license means Vulners holds no licence data, not this package is unlicensed. range is what separates the two cases you can tell apart:

`range`	`license`	What it means	Seen on
non-empty	non-empty	A licence is on record for that span.	`npm/[email protected]` → `["MIT"]`
non-empty	`[]`	A record matched, but it carries no licence.	`pypi/[email protected]` → `">=, <1.0.0"`, `[]`
`""`	`[]`	Nothing matched — the package or version is unknown here.	`hex/[email protected]`, `composer/guzzlehttp/[email protected]`

Coverage is uneven by registry, so treat an empty answer as "unknown", not as a negative result.

An unknown registry, or a mis-shaped name, returns 500

A registry outside the table above (bitnami, conda, PyPI), or a name shaped for a different registry ({"registry": "maven", "name": "log4j-core"}), currently fails with a plain-text Internal Server Error rather than the 400 and JSON envelope the rest of v4 returns. Validate both before sending. A missing or mistyped field does answer with a normal 400.

Usage:

curl Python Response

Query:

POST /api/v4/audit/metadata

A PyPI package:

curl -XPOST https://vulners.com/api/v4/audit/metadata \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"registry": "pypi", "name": "requests", "version": "2.32.5"}'

Maven — groupId:artifactId:

curl -XPOST https://vulners.com/api/v4/audit/metadata \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"registry": "maven", "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1"}'

Nothing on record (still a 200):

curl -XPOST https://vulners.com/api/v4/audit/metadata \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"registry": "composer", "name": "guzzlehttp/psr7", "version": "2.7.1"}'

# This endpoint has no typed wrapper yet — use the client's raw POST escape hatch.
# Escape hatches return the raw response shown in the Response tab: read data under ["result"].
meta = v.post("/api/v4/audit/metadata",
              json={"registry": "pypi", "name": "requests", "version": "2.32.5"})["result"]

# Maven — the name is groupId:artifactId
v.post("/api/v4/audit/metadata",
       json={"registry": "maven",
             "name": "org.apache.logging.log4j:log4j-core",
             "version": "2.14.1"})

# Nothing on record — range "" and license []
v.post("/api/v4/audit/metadata",
       json={"registry": "composer", "name": "guzzlehttp/psr7", "version": "2.7.1"})

A licence on record:

{
  "result": {
    "name": "org.apache.logging.log4j:log4j-core",
    "version": "2.14.1",
    "range": ">=, <",
    "license": ["Apache-2.0"]
  }
}

Nothing on record:

{
  "result": {
    "name": "guzzlehttp/psr7",
    "version": "2.7.1",
    "range": "",
    "license": []
  }
}

CVE Audit¶

Look up everything affected by a CVE: pass a CVE identifier and get back every affected package (with its vulnerable version range and distro/arch scope) and every affected CPE configuration. Useful for triage and for turning a CVE into actionable fix data without scanning a host or dependency list first.

The endpoint takes only the cve field now — the old registry and include_* filters have been removed. To look up many CVEs at once, use the batch /api/v4/audit/cves endpoint below.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`cve`	body	string	yes	CVE (or CAN) identifier. Must match `C(VE\\|AN)-YYYY-NNNN+`. Auto-uppercased server-side.

Response schema:

The endpoint returns a JSON object with a single result key:

Field	Type	Description
`result.cve`	string	The queried CVE identifier (uppercased).
`result.affectedPackages`	array[object]	Affected packages. Empty array if none matched.
`result.affectedCpe`	array[object]	Affected CPE configurations. Empty array if none matched.

Each affectedPackages[] entry always includes id, name, range, and registry. The distro, arch, and classifier fields are omitted from the JSON when not applicable (they are not returned as null).

Field	Type	Always present	Description
`id`	string	yes	Source advisory id for the match (e.g. `UB:CVE-2026-42945`, `OSV:DEBIAN-CVE-2026-42945`).
`name`	string	yes	Package name as it appears in the registry.
`range`	string	yes	Vulnerable version range (e.g. `<1.18.0-6ubuntu14.11`, `>=2,<2.17.1`).
`registry`	string	yes	Registry the package belongs to (e.g. `deb`, `rpm`, `apk`, `maven`, `npm`).
`distro`	array[string]	—	Distribution scope (e.g. `["ubuntu", "ubuntu-22.04"]`). Present only for OS-package registries.
`arch`	array[string]	—	Architectures affected. Present only when the advisory is architecture-specific.
`classifier`	array[string]	—	Extra classifiers (e.g. Maven classifiers). Present only when the advisory targets one.

Each affectedCpe[] entry:

Field	Type	Description
`id`	string	Source advisory id (e.g. `F5:K000161019`).
`type`	string	Source / bulletin type (e.g. `f5`, `cve`).
`cpeConfigurations`	object	CPE applicability tree under a `vulnersCpeConfiguration` key — nested AND/OR `nodes` of `cpeMatch` entries with `criteria`, `vulnerable`, and optional version bounds (NVD configuration format).

Usage:

curl Python Response

Query:

POST /api/v4/audit/cve

Example:

curl -XPOST https://vulners.com/api/v4/audit/cve \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"cve": "CVE-2026-42945"}'

v.audit.cve_audit(cve="CVE-2026-42945")

{
  "result": {
    "cve": "CVE-2026-42945",
    "affectedPackages": [
      {
        "id": "UB:CVE-2026-42945",
        "name": "nginx-core",
        "range": "<1.18.0-6ubuntu14.11",
        "registry": "deb",
        "distro": ["ubuntu", "ubuntu-22.04"]
      },
      {
        "id": "OSV:DEBIAN-CVE-2026-42945",
        "name": "nginx",
        "range": ">=1.18.0-6.1,<1.18.0-6.1+deb11u6",
        "registry": "deb",
        "distro": ["debian", "debian-11"]
      }
    ],
    "affectedCpe": [
      {
        "id": "F5:K000161019",
        "type": "f5",
        "cpeConfigurations": {
          "vulnersCpeConfiguration": [
            {
              "operator": "OR",
              "nodes": [
                {
                  "operator": "OR",
                  "negate": false,
                  "cpeMatch": [
                    {
                      "vulnerable": true,
                      "versionEndExcluding": "37.0.0",
                      "criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
                      "provider": "f5_software"
                    }
                  ]
                }
              ]
            }
          ]
        }
      }
    ]
  }
}

Batch CVE Audit¶

Same as CVE Audit, but for up to 500 CVEs in one request. Send cve as an array; the response result is an array with one entry per CVE (same shape as the single-CVE result).

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`cve`	body	array[string]	yes	1–500 CVE (or CAN) identifiers. Auto-uppercased server-side.

Usage:

curl Python Response

Query:

POST /api/v4/audit/cves

Example:

curl -XPOST https://vulners.com/api/v4/audit/cves \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{"cve": ["CVE-2026-42945", "CVE-2021-44228"]}'

results = v.audit.cve_batch_audit(["CVE-2026-42945", "CVE-2021-44228"])
for entry in results:   # one entry per CVE, same shape as the single-CVE audit
    print(entry["cve"], "-", len(entry["affectedPackages"]), "affected packages")

{
  "result": [
    {
      "cve": "CVE-2026-42945",
      "affectedPackages": [ ... ],
      "affectedCpe": [ ... ]
    },
    {
      "cve": "CVE-2021-44228",
      "affectedPackages": [ ... ],
      "affectedCpe": [ ... ]
    }
  ]
}

SBOM Audit¶

Audit software components from an uploaded SBOM (Software Bill of Materials). Vulners parses the SBOM, extracts components, matches them to known packages/versions, and returns applicable advisories enriched with CVSS/EPSS/AI scoring when available.

Auth: X-Api-Key header required.

Content-Type: multipart/form-data
Form field: file (SBOM JSON)

Supported formats

SPDX (v2.x) — JSON
CycloneDX (v1.x) — JSON

Parameters

Name	In	Type	Required	Description
`file`	form	file	yes	SBOM file in SPDX/CycloneDX JSON.
`cvelistMetrics`	query	boolean	no	Add the per-CVE breakdown to each advisory. Default `false`.
`fields`	query	array[string]	no	The other spelling: `?fields=cvelistMetrics`. The body is the SBOM file, so the request rides in the query string.

Response schema:

Each entry in result.data describes one component extracted from the SBOM:

Field	Type	Description
`package`	string	Component name.
`version`	string	Component version reported by the SBOM.
`fixedVersion`	string \| null	Latest known fixed version, if any.
`applicableAdvisories`	array[object]	Matching advisories (see below). Empty array if none.

Alongside data, the response carries totalPackages, appliedOptions (what the server honoured) and warnings (options accepted and not acted on).

Each advisory in applicableAdvisories:

Field	Type	Description
`id`	string	Advisory identifier (e.g. `OSV:...`, `USN-...`, `DSA-...`).
`match`	string	Version range that matched (e.g. `>=3.11.0,<3.11.5`).
`registry`	string	Package registry: `deb`, `apk`, `rpm`, `maven`, `pypi`, `bitnami`, …
`distro`	array[string] \| null	OS distribution scope, e.g. `["ubuntu", "ubuntu-22.04"]`.
`arch`	array[string] \| null	Architectures, e.g. `["amd64", "arm64"]`.
`classifier`	array[string] \| null	Ubuntu-only labels — see note below.
`type`	string	Advisory source type (e.g. `osv`, `ubuntu`, `debian`).
`title`	string	Short advisory title.
`description`	string	Advisory description.
`published`	string	ISO 8601 publication timestamp.
`epss`	array[object]	Per-CVE EPSS entries: `cve`, `epss`, `percentile`, `date`.
`aiScore`	object	AI-derived severity: `value`, `uncertainty`.
`metrics`	object	CVSS/EPSS metrics for the advisory.
`exploitation`	object	Wild exploitation: `wildExploited`, `wildExploitedSources`.
`references`	array[string]	Advisory reference URLs.
`cvelist`	array[string]	CVE IDs covered by this advisory.

distro, arch, and classifier are null when the advisory isn't scoped that way (non-OS advisories, architecture-agnostic advisories, non-Ubuntu advisories). The classifier field is currently only populated for Ubuntu advisories, with values drawn from candidate, unofficial, transitive.

Usage:

curl Python Response

Query:

POST /api/v4/audit/sbom

Example:

curl -X POST "https://vulners.com/api/v4/audit/sbom" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -F "file=@/path/to/sbom.json"

Replace YOUR_API_KEY with your Vulners API key and /path/to/sbom.json with the path to your SBOM file.

report = v.audit.sbom_audit("/path/to/sbom.json")   # SPDX or CycloneDX JSON; the SDK unwraps the `result` envelope
for component in report["data"]:
    print(component["package"], component["version"], "->", len(component["applicableAdvisories"]), "advisories")

On success, the endpoint returns a JSON object with a result envelope containing the matched components under data, plus a summaryId and totalPackages count. Components with no matches are returned with an empty applicableAdvisories array.

{
  "result": {
    "data": [
      {
        "package": "python",
        "version": "3.11.4",
        "fixedVersion": "3.15.0",
        "applicableAdvisories": [
          {
            "id": "OSV:BIT-PYTHON-2023-41105",
            "match": ">=3.11.0,<3.11.5",
            "registry": "bitnami",
            "distro": null,
            "arch": null,
            "classifier": null,
            "type": "osv",
            "title": "BIT-PYTHON-2023-41105",
            "description": "An issue was discovered in Python 3.11 through 3.11.4 ...",
            "published": "2024-10-04T16:35:59",
            "epss": [
              {
                "cve": "CVE-2023-41105",
                "epss": 0.00363,
                "percentile": 0.57892,
                "date": "2026-02-27"
              }
            ],
            "aiScore": {
              "value": 7.3,
              "uncertainty": 0.2
            },
            "metrics": {
              "cvss": {
                "score": 7.5,
                "severity": "HIGH",
                "version": "3.1",
                "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "source": "nvd"
              },
              "epss": ["CVE-2023-41105"]
            },
            "exploitation": {
              "wildExploited": false,
              "wildExploitedSources": []
            },
            "references": [
              "https://nvd.nist.gov/vuln/detail/CVE-2023-41105"
            ],
            "cvelist": ["CVE-2023-41105"]
          },
          {
            "id": "USN-6891-1",
            "match": "<3.11.6-0ubuntu1",
            "registry": "deb",
            "distro": ["ubuntu", "ubuntu-22.04"],
            "arch": ["amd64", "arm64"],
            "classifier": ["candidate", "transitive"],
            "type": "ubuntu",
            "title": "Python vulnerabilities",
            "description": "Several issues were fixed in Python.",
            "published": "2024-06-20T00:00:00",
            "epss": [],
            "aiScore": { "value": 6.8, "uncertainty": 0.4 },
            "metrics": {
              "cvss": {
                "score": 7.5,
                "severity": "HIGH",
                "version": "3.1",
                "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "source": "ubuntu"
              },
              "epss": []
            },
            "exploitation": {
              "wildExploited": false,
              "wildExploitedSources": []
            },
            "references": [
              "https://ubuntu.com/security/notices/USN-6891-1"
            ],
            "cvelist": ["CVE-2023-41105"]
          }
        ]
      },
      {
        "package": "Simple Launcher",
        "version": "1.1.0.14",
        "fixedVersion": null,
        "applicableAdvisories": []
      }
    ],
    "summaryId": "8e46a7a2c5943fe9914369e20a54c615",
    "totalPackages": 8
  }
}

Errors

401 Unauthorized — missing/invalid X-Api-Key.
403 Forbidden — IP not allowed or insufficient license scope.
400 Bad Request — invalid/unsupported SBOM format or malformed JSON.

Best practices

Validate SPDX/CycloneDX JSON before upload.
Include PURLs and consistent package identifiers to improve matching.
Use metrics.cvss and epss to prioritize remediation.
Narrow results by registry, distro, and arch when audit output covers multiple ecosystems; use classifier to filter Ubuntu-specific labels (candidate, unofficial, transitive).

Windows Audit¶

Audit Windows updates (v4)¶

Turns a host's installed-update list into the updates it is missing — one finding per update, naming the KB to install.

Quick notes: - kbList is required — up to 2500 entries. KB5041160, kb5041160 and 5041160 all name the same update. - osName labels the result and is echoed back as package; send whatever the host calls itself. What is missing is decided by kbList alone. - fields accepts metrics and cvelistMetrics; anything else is rejected with 400. - Each advisory carries supersedes[] — the updates this one replaces. It is the answer to why installing a single update clears a four-figure CVE count.

Auth: X-Api-Key header required.

Request body parameters:

Field	Type	Required	Description
`osName`	string	yes	What the host calls itself, e.g. `Windows Server 2022`. Reported back as `package`.
`kbList`	array[string]	yes	Installed update identifiers. Min 1 / Max 2500.
`osVersion`	string	no	OS build, e.g. `10.0.20348`. Echoed back on the item.
`fields`	array[string]	no	`metrics` and/or `cvelistMetrics`.
`cvelistMetrics`	boolean	no	The other spelling of `fields: ["cvelistMetrics"]`.

Usage:

curl Response

Query:

POST /api/v4/audit/kb

Query example:

curl -sS -X POST "https://vulners.com/api/v4/audit/kb" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  --data-binary @- << 'JSON'
{
  "osName": "Windows Server 2022",
  "osVersion": "10.0.20348",
  "kbList": ["KB5041160"],
  "fields": ["metrics", "cvelistMetrics"]
}
JSON

{
  "result": {
    "totalPackages": 1,
    "items": [{
      "package": "Windows Server 2022",
      "version": "10.0.20348",
      "fixedPackage": "KB5120242",
      "advisories": [{
        "id": "KB5120242",
        "type": "mskb",
        "title": "August 11, 2026—KB5120242 (OS Build 20348.5499)",
        "href": "https://support.microsoft.com/en-us/help/5120242",
        "severity": "Important",
        "msfamily": "Windows",
        "affectedProducts": ["Windows Server 2022", "Windows Server 2022 (Server Core installation)"],
        "supersedes": ["KB5004243", "KB5004957", "..."],
        "cvelist": ["CVE-2025-59287", "..."],
        "metrics": {"cvss": {"score": 9.9, "severity": "CRITICAL"}},
        "cvelistMetrics": [{"cve": "CVE-2025-59287", "cvss": {"score": 9.9}, "ssvc": {"options": [{"Exploitation": "active"}]}}]
      }]
    }]
  }
}

Response fields:

Field	Description
`items[].package`	The `osName` you sent.
`items[].fixedPackage`	The update to install: the newest non-preview cumulative among those missing.
`advisories[].supersedes`	Updates this one replaces. Explains the CVE count.
`advisories[].affectedProducts`	Display label, not a matching key — no version, and empty on updates that fix nothing. Fall back to `title` or `msfamily`.
`advisories[].cvelist`	CVEs this update and its superseded chain remediate.

Send the whole installed list

Listing updates that a newer one already contains does not add findings. The audit excludes what the host is already at or past, so a fully patched host answers with no advisories however many updates it names.

Audit Windows via KB (v3, deprecated)¶

Superseded by /api/v4/audit/kb

This endpoint returns every missing CVE in one flat list with nothing tying them to the update that fixes them, so a stale host becomes thousands of findings with no remediation. It still works and is unchanged; new integrations should use the v4 endpoint above.

Quick audit of Windows hosts by OS version + installed KB list. Good for patch status checks.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`os`	body	string	yes	OS name/version (e.g., Windows Server 2012 R2)
`kbList`	body	array[string]	yes	Array of installed KB IDs (e.g., `["KB5009586","KB5009624"]`).

Usage:

curl Python Full response need_2_install_kb affected_cve

Query:

POST /api/v3/audit/kb/

Query example:

curl -XPOST https://vulners.com/api/v3/audit/kb/ -H "X-Api-Key: YOUR_API_KEY" -H 'Content-Type: application/json' -d '{
"os": "Windows Server 2012 R2", # (1)
"kbList": ["KB5009586", "KB5009624", "KB5008230", "KB5007247", "KB5005693", "KB5007205", "KB5003646"] 
# (2)
}'

OS version can be obtained from systeminfo
Installed KBs is also via systeminfo or via wmic qfe list.

win_vulners = v.audit.kb_audit(
    os="Windows Server 2016", kb_list=["KB5009586", "KB5009624", "KB5008230", "KB5007247", "KB5005693", "KB5007205", "KB5003646"])
need_2_install_kb = win_vulners['kbMissed']
affected_cve = win_vulners['cvelist']
latest_kb = win_vulners['kbLatest']  # latest applicable KB for the OS

{
    "result": "OK",
    "data": {
        "kbLatest": "KB5034119",
        "kbMissed": ["KB5000803", "KB5017095", "..."],
        "cvelist":  ["CVE-2021-36942", "CVE-2021-31958", "..."]
    }
}

[
    "KB5000803",
    "KB5017095",
    "KB5011495",
    "KB5003638",
    "KB5009546",
    "KB5012596",
    "KB5004948",
    "KB5001347",
    "KB5007192",
    "KB5004238",
    "KB5010359",
    "KB5014702",
    "KB5016622",
    "KB4601318",
    "KB5005573",
    "KB5008207",
    "KB5006669",
    "KB5012170",
    "KB5015808",
    "KB5005043",
    "KB5013952",
    "KB5003197"
]

[   "CVE-2021-36942",
    "CVE-2021-31958",
    "CVE-2022-34302",
    "CVE-2022-30166",
    "CVE-2022-22002",
    "CVE-2021-1640",
    "CVE-2021-24111",
    "CVE-2022-26832",
    "CVE-2021-33757",
    "CVE-2021-41361",
    "CVE-2021-36938",
    "CVE-2020-1036",
    "CVE-2021-42279",
    "CVE-2022-34303",
    "CVE-2021-28318",
    "CVE-2020-1472",
    "CVE-2022-21897",
    "CVE-2021-38667",
    "CVE-2021-31959",
    "CVE-2021-34481",
    "CVE-2022-30154",
    "CVE-2021-34459",
    "CVE-2022-23293",
    "CVE-2020-17049",
    "CVE-2020-26784",
    "CVE-2022-22048",
    "CVE-2021-33779",
    "CVE-2021-43893",
    "CVE-2022-26784",
    "CVE-2021-26419",
    "CVE-2021-34527",
    "CVE-2022-35822",
    "CVE-2022-34301",
    "CVE-2022-30138",
    "CVE-2021-26411"
]

Windows KB superseding/parentseeding¶

Refer to this if you need more information about KB after the previous method. Superseded information will be returned as a dictionary with two fields: superseeds, parentseeds.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`id`	body	string	yes	KB identifier (e.g., KB4524135).
`fields`	body	string	yes	Include superseeds and/or parentseeds.

Usage:

curl Python Response

Query:

POST /api/v3/search/id/

Query example:

curl -XPOST https://vulners.com/api/v3/search/id/ -H "X-Api-Key: YOUR_API_KEY" -H 'Content-Type: application/json' -d '{
    "id": "KB4524135", 
    "fields": [
        "superseeds", # (1)
        "parentseeds" # (2)
    ]
}'

Superseeds means "what KB are covered by this KB".
Parentseeds means "what KB are covering this KB".

kb = v.search.get_bulletin("KB4524135", fields=["superseeds", "parentseeds"])
superseeds = kb.superseeds      # KBs covered by this KB
parentseeds = kb.parentseeds    # KBs covering this KB

{
    "superseeds": [
        "KB3021952",
        "KB4103768",
        "KB2699988",
        "KB3100773",
        "KB931768",
        "KB4466536",
        "KB4343205",
        "KB896688",
        "KB4462949",
        "KB2977629",
        "KB2817183",
        "KB972260",
        "KB4457426",
        "KB980182",
        "KB929969",
        "KB4470199",
        "KB2544521",
        "KB4511872",
        "KB2744842",
        "KB2879017",
        "KB2497640",
        "KB2360131",
        "KB4025252",
        "KB2829530",
        "KB4047206",
        "KB3093983",
        "KB4507434",
        "KB4056568",
        "KB960714",
        "KB2530548",
        "KB3203621",
        "KB833989",
        "KB2761451",
        "KB3139929",
        "KB4339093",
        "KB4483187",
        "KB969897",
        "KB910620",
        "KB942615",
        "KB956390",
        "KB937143",
        "KB4052978",
        "KB2416400",
        "KB4018271",
        "KB2987107",
        "KB2870699",
        "KB982381",
        "KB2183461",
        "KB2586448",
        "KB958215",
        "KB963027",
        "KB2862772",
        "KB4012204",
        "KB4036586",
        "KB3175443",
        "KB933566",
        "KB947864",
        "KB2647516",
        "KB4486474",
        "KB944533",
        "KB2976627",
        "KB4074736",
        "KB2792100",
        "KB905915",
        "KB922760",
        "KB4489873",
        "KB883939",
        "KB2797052",
        "KB2909212",
        "KB4230450",
        "KB3003057",
        "KB4092946",
        "KB2963952",
        "KB978207",
        "KB4034733",
        "KB939653",
        "KB976325",
        "KB3154070",
        "KB4040685",
        "KB3038314",
        "KB928090",
        "KB2675157",
        "KB4493435",
        "KB3197655",
        "KB896727",
        "KB3034196",
        "KB3049563",
        "KB3032359",
        "KB2618444",
        "KB974455",
        "KB938127",
        "KB2838727",
        "KB3148198",
        "KB3191492",
        "KB3170106",
        "KB2559049",
        "KB2809289",
        "KB3058515",
        "KB4014661",
        "KB4516046",
        "KB950759",
        "KB925486",
        "KB3036197",
        "KB3124275",
        "KB2799329",
        "KB3008923",
        "KB3078071",
        "KB953838",
        "KB3065822",
        "KB2722913",
        "KB4021558",
        "KB3104002",
        "KB912812",
        "KB918899",
        "KB2482017",
        "KB3160005",
        "KB2962872",
        "KB4096040",
        "KB916281",
        "KB3185319",
        "KB3087038",
        "KB4480965",
        "KB2761465",
        "KB4089187",
        "KB2846071",
        "KB890923",
        "KB4503259",
        "KB4498206",
        "KB3134814"
    ],
    "parentseeds": [
        "KB4571687",
        "KB4534251",
        "KB4540671",
        "KB4586768",
        "KB4519974",
        "KB4525106",
        "KB4530677",
        "KB4556798",
        "KB4565479",
        "KB4561603",
        "KB4537767",
        "KB4550905",
        "KB4577010"
    ]
}

Get the list of Windows KB updates with download urls¶

Search Microsoft Catalog entries for KBs and return catalog URLs.

Auth: X-Api-Key header required.

Parameters:

Name	In	Type	Required	Description
`query`	body	string	yes	Lucene query, e.g. `type:msupdate AND kb:(KB4524135)`
`skip`	body	int	no	Offset (default 0).
`size`	body	int	no	Limit (default 100).

Usage:

curl Python Response

Query:

POST /api/v3/search/lucene/

Query example:

curl -XPOST https://vulners.com/api/v3/search/lucene/ -H "X-Api-Key: YOUR_API_KEY" -H 'Content-Type: application/json' -d '{
"query": "type:msupdate AND kb:(KB4524135)", 
"skip": 0, 
"size": 100, 
"fields": [
    "id", 
    "title", 
    "description", 
    "type", 
    "bulletinFamily", 
    "cvss", 
    "published", 
    "modified", 
    "lastseen", 
    "href", 
    "sourceHref", 
    "sourceData", 
    "cvelist"]
}'

page = v.search.query("type:msupdate AND kb:(KB4524135)", limit=100, fields=["href"])
updates_download_links = [update.href for update in page.data]

[
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=ef31383a-7932-441a-a626-f0a145cc422a",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=18552c40-7e36-4f15-960a-9717a4912af1",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=375f016c-b4ac-4d71-9dee-8095427a3c86",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=2ca3d95f-1ecb-4850-aeb4-afb63cd6374a",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=72890150-da44-47b2-b1b5-7dce2d5d1a30",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=fba96f27-5955-45e1-82e5-ad350b4627e0",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=9668152f-78a1-44f9-a229-38e86189703a",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=e08d28ef-d685-412c-b0bc-8cc26bf899c3",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=a22dcbac-485a-4834-8556-fee2e437ab9b",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=db62995c-3814-4fd7-a481-dc285f0640e2",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=16216817-6043-4587-a803-9b3a9f3a58cc",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=393d67e1-8827-4c6d-9187-b6320a9a03bc",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=b18abca1-c8ec-4e43-9fa0-cc2b2a518304",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=96c42c78-234b-4ae7-b097-be0eb8ac6f25",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=63cc9ae6-6d02-4936-8b77-b976b440ff25",
    "https://www.catalog.update.microsoft.com/ScopedViewInline.aspx?updateid=2661795f-8beb-468f-9c4f-0de83724a90f"
]

Linux Audit¶

Analyze installed Linux packages (RPM, DEB, APK) and match them against Vulners vulnerability database. This endpoint is intended for fast, batch auditing of package lists exported from servers, containers or build images.

Supported systems¶

Fetch all currently supported operating systems. These values are used as inputs for the audit request below.

Auth: X-Api-Key header required.

Parameters: None

Usage:

curl Response

Query:

GET /api/v3/audit/getSupportedOS

Query example:

curl -G "https://vulners.com/api/v3/audit/getSupportedOS" -H "X-Api-Key: YOUR_API_KEY"

data.supportedOS is a map from OS short name to the shell snippet Vulners recommends for enumerating installed packages.

{
    "result": "OK",
    "data": {
        "supportedOS": {
            "centos": "rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\\n'",
            "ubuntu": "dpkg-query -W -f='${binary:Package} ${Version} ${Architecture}\\n'",
            "alpine": "apk info -vv",
            "rhel":   "rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\\n'"
        }
    }
}

Audit Linux hosts¶

Check installed packages against known vulnerabilities and retrieve matching advisories.

Quick notes: - Accepts package lists from RPM (RHEL/CentOS/OL), DEB (Debian/Ubuntu) and APK (Alpine). - packages is required — up to 2500 entries per request. - osName and osVersion are required so the matcher can pick the right distro feed. - Enrichment is opt-in and available on every licence — see Enrichment for the request forms and what comes back. - Alongside result.issues the response carries result.errors (map of input-package index → parser error), result.totalPackages (count of parsed packages), and result.appliedOptions / result.warnings. - Issues come back worst first — advisory count, then package name — not in request order. Join on package, which echoes the request line verbatim.

Auth: X-Api-Key header required.

Request body parameters:

Field	Type	Required	Description
`osName`	string	yes	OS name or ID (`ubuntu`, `debian`, `rhel`, `ol`, `alpine`, etc.).
`osVersion`	string	yes	OS version (e.g. `22.04`, `7`, `8.6`, ...).
`osArch`	string	no	OS architecture (e.g. `x86_64`, `aarch64`) — used as default arch for packages when not specified.
`packages`	array[string]	yes	List of packages (strings). Each item should be the package name with version and, if applicable, arch. Min 1 / Max 2500 entries.
`includeUnofficial`	boolean	no	If `true`, include matches from unofficial sources (third‑party repos). Default: `false`.
`includeCandidates`	boolean	no	If `true`, include "candidate" findings (lower confidence or tentative matches). Default: `false`.
`includeAnyVersion`	boolean	no	If `true`, include vulnerabilities that match any version (broad/less strict matching). Default: `false`.
`cvelistMetrics`	boolean	no	Add the per-CVE breakdown to each advisory. Default: `false`.
`fields`	array[string]	no	`metrics` and/or `cvelistMetrics`. Values this endpoint cannot answer are accepted and reported back in `warnings`.

Usage:

curl Python Response

Query:

POST /api/v4/audit/linux

Query example:

curl -sS -X POST "https://vulners.com/api/v4/audit/linux" \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: YOUR_API_KEY" \
  --data-binary @- << 'JSON'
{
  "osName": "ubuntu",
  "osVersion": "22.04",
  "packages": [
    "bash 5.1-6ubuntu1.2 amd64",
    "openssl 3.0.2-0ubuntu1.10 amd64",
    "nginx 1.18.0-0ubuntu1 amd64"
  ],
  "includeUnofficial": false,
  "includeCandidates": false,
  "includeAnyVersion": false,
  "cvelistMetrics": false
}
JSON

v.audit.linux_audit(
    os_name="ubuntu",
    os_version="22.04",
    packages=[
        "bash 5.1-6ubuntu1.2 amd64",
        "openssl 3.0.2-0ubuntu1.10 amd64",
        "nginx 1.18.0-0ubuntu1 amd64"
    ],
    include_unofficial=False,
    include_candidates=False,
    include_any_version=False,
)

{
    "result": {
        "issues": [
            {
                "package": "nginx 1.18.0-0ubuntu1 amd64",
                "fixedPackage": "nginx_1.18.0-6ubuntu14.7_noarch.deb",
                "applicableAdvisories": [
                    {
                        "id": "USN-5371-2",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.1"
                    },
                    {
                        "id": "USN-5722-1",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.3"
                    },
                    {
                        "id": "UB:CVE-2024-7347",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.5"
                    },
                    {
                        "id": "USN-7014-1",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.5"
                    },
                    {
                        "id": "USN-7285-1",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.6"
                    },
                    {
                        "id": "USN-7715-1",
                        "operator": "lt",
                        "version": "1.18.0-6ubuntu14.7"
                    }
                ]
            },
            {
                "package": "openssl 3.0.2-0ubuntu1.10 amd64",
                "fixedPackage": "openssl_3.0.2-0ubuntu1.20_noarch.deb",
                "applicableAdvisories": [
                    {
                        "id": "USN-6450-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.12"
                    },
                    {
                        "id": "USN-6622-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.14"
                    },
                    {
                        "id": "USN-6663-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.15"
                    },
                    {
                        "id": "USN-6854-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.16"
                    },
                    {
                        "id": "USN-6937-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.17"
                    },
                    {
                        "id": "UB:CVE-2024-6119",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.18"
                    },
                    {
                        "id": "USN-6986-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.18"
                    },
                    {
                        "id": "UB:CVE-2024-9143",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.19"
                    },
                    {
                        "id": "USN-7278-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.19"
                    },
                    {
                        "id": "USN-7786-1",
                        "operator": "lt",
                        "version": "3.0.2-0ubuntu1.20"
                    }
                ]
            }
        ],
        "errors": []
    }
}

Response schema:

Field	Type	Description
`result.issues`	array[object]	One entry per vulnerable package. Worst first: advisory count, then package name.
`result.errors`	object	Parser errors, keyed by the package's 0-based index in the request. `{}` when everything parsed.
`result.totalPackages`	integer	Count of packages that parsed successfully.
`result.appliedOptions`	array[string]	Options the server actually honoured.
`result.warnings`	array[object]	Options accepted and not acted on, each with `option` and `message`.

Each result.issues[] entry:

Field	Type	Description
`package`	string	Echoes the request line verbatim — the key to join on.
`version`	string	Installed version parsed from the input.
`fixedVersion`	string	Version that fixes it. Omitted when no fix is known.
`fixedPackage`	string	The same fix as a package string ready to install.
`applicableAdvisories`	array[object]	Matching advisories.

Each applicableAdvisories[] entry. Optional fields are omitted when absent, not returned as null:

Field	Type	Description
`id`	string	Advisory identifier (e.g. `USN-…`, `DSA-…`, `RHSA-…`).
`match`	string	Vulnerable version range that matched.
`operator`	string	Comparison the match used: `lt`, `le` or `eq`.
`version`	string	Version the comparison was made against.
`registry`	string	Package registry the advisory targets (`deb`, `rpm`, `apk`).
`distro`	array[string]	Distribution scope, e.g. `["ubuntu", "ubuntu-22.04"]`.
`arch`	array[string]	Affected architectures.
`published`	string	Advisory publication date.
`metrics`	object	Advisory-level rollup: `cvss` and `epss`, the highest across this advisory's CVEs. Requested via `fields`.
`exploitation`	object	`wildExploited` and its sources. Requested via `fields`.
`cvelistMetrics`	array[object]	One entry per CVE — `cvss`, `epss`, `exploitation`, `ai_score`, `ssvc`. See Enrichment.