---
title: "List global security advisories"
method: GET
path: "/advisories"
tags: ["security-advisories"]
---

# List global security advisories

`GET /advisories`

Lists all global security advisories that match the specified parameters. If no other parameters are defined, the request will return only GitHub-reviewed advisories that are not malware.

By default, all responses will exclude advisories for malware, because malware are not standard vulnerabilities. To list advisories for malware, you must include the `type` parameter in your request, with the value `malware`. For more information about the different types of security advisories, see "[About the GitHub Advisory database](https://docs.github.com/enterprise-cloud@latest/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database#about-types-of-security-advisories)."

## Query parameters

- `ghsa_id` string
- `type` 'reviewed' | 'malware' | 'unreviewed'
- `cve_id` string
- `ecosystem` 'rubygems' | 'npm' | 'pip' | 'maven' | 'nuget' | 'composer' | 'go' | 'rust' | 'erlang' | 'actions' | 'pub' | 'other' | 'swift' — The package's language or package management ecosystem.
- `severity` 'unknown' | 'low' | 'medium' | 'high' | 'critical'
- `cwes` union
  - string
  - string[]
- `is_withdrawn` boolean
- `affects` union
  - string
  - string[]
- `published` string
- `updated` string
- `modified` string
- `epss_percentage` string
- `epss_percentile` string
- `before` string
- `after` string
- `direction` 'asc' | 'desc'
- `per_page` integer
- `sort` 'updated' | 'published' | 'epss_percentage' | 'epss_percentile'

## Response `200`

Response

- GlobalAdvisory[]
  - `ghsa_id` string, required — The GitHub Security Advisory ID.
  - `cve_id` string, nullable, required — The Common Vulnerabilities and Exposures (CVE) ID.
  - `url` string, required — The API URL for the advisory.
  - `html_url` string, uri, required — The URL for the advisory.
  - `repository_advisory_url` string, uri, nullable, required — The API URL for the repository advisory.
  - `summary` string, required — A short summary of the advisory.
  - `description` string, nullable, required — A detailed description of what the advisory entails.
  - `type` 'reviewed' | 'unreviewed' | 'malware', required — The type of advisory.
  - `severity` 'critical' | 'high' | 'medium' | 'low' | 'unknown', required — The severity of the advisory.
  - `source_code_location` string, uri, nullable, required — The URL of the advisory's source code.
  - `identifiers` object[], nullable, required
    - `type` 'CVE' | 'GHSA', required — The type of identifier.
    - `value` string, required — The identifier value.
  - `references` string[], nullable, required
  - `published_at` string, date-time, required — The date and time of when the advisory was published, in ISO 8601 format.
  - `updated_at` string, date-time, required — The date and time of when the advisory was last updated, in ISO 8601 format.
  - `github_reviewed_at` string, date-time, nullable, required — The date and time of when the advisory was reviewed by GitHub, in ISO 8601 format.
  - `nvd_published_at` string, date-time, nullable, required — The date and time when the advisory was published in the National Vulnerability Database, in ISO 8601 format. This field is only populated when the advisory is imported from the National Vulnerability Database.
  - `withdrawn_at` string, date-time, nullable, required — The date and time of when the advisory was withdrawn, in ISO 8601 format.
  - `vulnerabilities` Vulnerability[], nullable, required — The products and respective version ranges affected by the advisory.
    - `package` object, nullable, required — The name of the package affected by the vulnerability.
      - `ecosystem` 'rubygems' | 'npm' | 'pip' | 'maven' | 'nuget' | 'composer' | 'go' | 'rust' | 'erlang' | 'actions' | 'pub' | 'other' | 'swift', required — The package's language or package management ecosystem.
      - `name` string, nullable, required — The unique package name within its ecosystem.
    - `vulnerable_version_range` string, nullable, required — The range of the package versions affected by the vulnerability.
    - `first_patched_version` string, nullable, required — The package version that resolves the vulnerability.
    - `vulnerable_functions` string[], nullable, required — The functions in the package that are affected by the vulnerability.
  - `cvss` object, nullable, required
    - `vector_string` string, nullable, required — The CVSS vector.
    - `score` number, nullable, required — The CVSS score.
  - `cvss_severities` CvssSeverities, nullable
    - `cvss_v3` object, nullable
      - `vector_string` string, nullable, required — The CVSS 3 vector string.
      - `score` number, nullable, required — The CVSS 3 score.
    - `cvss_v4` object, nullable
      - `vector_string` string, nullable, required — The CVSS 4 vector string.
      - `score` number, nullable, required — The CVSS 4 score.
  - `epss` SecurityAdvisoryEpss, nullable — The EPSS scores as calculated by the [Exploit Prediction Scoring System](https://www.first.org/epss).
    - `percentage` number
    - `percentile` number
  - `cwes` object[], nullable, required
    - `cwe_id` string, required — The Common Weakness Enumeration (CWE) identifier.
    - `name` string, required — The name of the CWE.
  - `credits` object[], nullable, required — The users who contributed to the advisory.
    - `user` SimpleUser, required — A GitHub user.
      - `name` string, nullable
      - `email` string, nullable
      - `login` string, required
      - `id` integer, required
      - `node_id` string, required
      - `avatar_url` string, uri, required
      - `gravatar_id` string, nullable, required
      - `url` string, uri, required
      - `html_url` string, uri, required
      - `followers_url` string, uri, required
      - `following_url` string, required
      - `gists_url` string, required
      - `starred_url` string, required
      - `subscriptions_url` string, uri, required
      - `organizations_url` string, uri, required
      - `repos_url` string, uri, required
      - `events_url` string, required
      - `received_events_url` string, uri, required
      - `type` string, required
      - `site_admin` boolean, required
      - `starred_at` string
      - `user_view_type` string
    - `type` 'analyst' | 'finder' | 'reporter' | 'coordinator' | 'remediation_developer' | 'remediation_reviewer' | 'remediation_verifier' | 'tool' | 'sponsor' | 'other', required — The type of credit the user is receiving.

## Other responses

- `422` — Validation failed, or the endpoint has been spammed.
- `429` — Too many requests

---

[API](https://skmtc.net/github/apis/ghec.md) · [All operations](https://skmtc.net/github/apis/ghec/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/github/ghec/revisions/dc0584ac4e13/schema)