---
title: "Listing information about given vulnerability"
method: GET
path: "/query/vulnerabilities"
tags: ["Query"]
---

# Listing information about given vulnerability

`GET /query/vulnerabilities`

List (w/filters) vulnerability records known by the system, with affected packages information if present

## Query parameters

- `id` string[], required
- `affected_package` string
- `affected_package_version` string
- `page` string
- `limit` integer
- `namespace` string[]

## Response `200`

Vulnerability listing paginated

- PaginatedVulnerabilityList — A paginated listing of vulnerability records sorted by ID in descending order
  - `page` string — The page number returned (should match the requested page query string param)
  - `next_page` string — True if additional pages exist (page + 1) or False if this is the last page
  - `returned_count` integer — The number of items sent in this response
  - `vulnerabilities` StandaloneVulnerability[] — The listing of matching vulnerabilities for the query subject to pagination
    - `id` string — Vulnerability identifier. May be CVE-X, RHSA-X, etc. Not necessarily unique across namespaces
    - `namespace` string — The namespace for the vulnerability record to avoid conflicts for the same id in different distros or sources (e.g. deb vs ubuntu for same CVE)
    - `affected_packages` PackageReference[] — The array of packages (typically packages) that are vulnerable-to or provide fixes-for this vulnerability
      - `name` string — Package name
      - `version` string, nullable — A version for the package. If null, then references all versions
      - `type` string — Package type (e.g. package, rpm, deb, apk, jar, npm, gem, ...)
      - `will_not_fix` boolean — Whether a vendor will or will not fix a vulnerabitlity
    - `severity` 'Unknown' | 'Negligible' | 'Low' | 'Medium' | 'High' | 'Critical' — Severity label specific to the namepsace
    - `link` string — URL for the upstream CVE record in the reporting source (e.g. ubuntu security tracker)
    - `nvd_data` NvdDataObject[] — List of Nvd Data objects
      - `id` string — NVD Vulnerability ID
      - `cvss_v2` CVSSV2Scores
        - `base_score` number, nullable
        - `exploitability_score` number, nullable
        - `impact_score` number, nullable
      - `cvss_v3` CVSSV3Scores
        - `base_score` number, nullable
        - `exploitability_score` number, nullable
        - `impact_score` number, nullable
    - `vendor_data` VendorDataObject[] — List of Vendor Data objects
      - `id` string — Vendor Vulnerability ID
      - `cvss_v2` CVSSV2Scores
        - `base_score` number, nullable
        - `exploitability_score` number, nullable
        - `impact_score` number, nullable
      - `cvss_v3` CVSSV3Scores
        - `base_score` number, nullable
        - `exploitability_score` number, nullable
        - `impact_score` number, nullable
    - `description` string — Description of the vulnerability if available
    - `references` VulnerabilityReference[] — List of references including
      - `source` string — The reference source
      - `tags` string[]
      - `url` string — The reference url

## Other responses

- `400` — Invalid filter parameters

---

[API](https://skmtc.net/banzaicloud/apis/anchore-engine-api-server.md) · [All operations](https://skmtc.net/banzaicloud/apis/anchore-engine-api-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/banzaicloud/anchore-engine-api-server/revisions/38e5705e0b21/schema)