---
title: "List images vulnerable to the specific vulnerability ID."
method: GET
path: "/query/images/by_vulnerability"
tags: ["Query"]
---

# List images vulnerable to the specific vulnerability ID.

`GET /query/images/by_vulnerability`

Returns a listing of images and their respective packages vulnerable to the given vulnerability ID

## Query parameters

- `vulnerability_id` string, required
- `namespace` string
- `affected_package` string
- `severity` 'Unknown' | 'Negligible' | 'Low' | 'Medium' | 'High' | 'Critical'
- `vendor_only` boolean
- `page` integer
- `limit` integer

## Headers

- `x-anchore-account` string

## Response `200`

Image lookup success

- PaginatedVulnerableImageList — Pagination wrapped list of images with vulnerabilties that match some filter
  - `page` string — The page number returned (should match the requested page query string param)
  - `next_page` string — True if additional pages exist (page + 1) or False if this is the last page
  - `returned_count` integer — The number of items sent in this response
  - `images` VulnerableImage[]
    - `image` ImageReference — A summary of an image identity, including digest, id (if available), and any tags known to have ever been mapped to the digest
      - `digest` string — The image digest
      - `id` string — The image id if available
      - `analyzed_at` string — Timestamp, in rfc3339 format, indicating when the image state became 'analyzed' in Anchore Engine.
      - `tag_history` TagEntry[]
        - `pullstring` string — The pullable string for the tag. E.g. "docker.io/library/node:latest"
        - `registry` string — The registry hostname:port section of the pull string
        - `repository` string — The repository section of the pull string
        - `tag` string — The tag-only section of the pull string
        - `detected_at` string, date-time — The timestamp at which the Anchore Engine detected this tag was mapped to the image digest. Does not necessarily indicate when the tag was actually pushed to the registry.
    - `affected_packages` VulnerablePackageReference[]
      - `name` string — Package name
      - `version` string, nullable — A version for the package. If null, then references all versions
      - `type` string — Package type (e.g. package, rpm, deb, apk, jar, npm, gem, ...)
      - `severity` string — Severity of vulnerability affecting package
      - `namespace` string — Vulnerability namespace of affected package

## Other responses

- `400` — Invalid filter parameters

---

[API](https://skmtc.net/anchore/apis/anchore-engine-api-server.md) · [All operations](https://skmtc.net/anchore/apis/anchore-engine-api-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/anchore/anchore-engine-api-server/revisions/afb4f60ab44a/schema)