---
title: "Get a vulnerability"
method: GET
path: "/v1/vulnerabilities/{vulnerability_id}"
tags: ["Vulnerabilities"]
---

# Get a vulnerability

`GET /v1/vulnerabilities/{vulnerability_id}`

Get a vulnerability, along with any recommendation

## Path parameters

- `vulnerability_id` string, required — The id of the vulnerability.

## Response `200`

The vulnerability with recommendations.

- Vulnerability
  - `updated_at` string
  - `vuln_id` string, nullable, required
  - `url` string, nullable, required
  - `nist_url` string, nullable, required
  - `description` string, nullable, required
  - `cvss_score` string, nullable
  - `severity` string, nullable, required
  - `epss_percentile` string, nullable
  - `epss_probability` string, nullable
  - `epss_score` string, nullable
  - `known_exploited` boolean
  - `cwe_ids` string[]
  - `affected_packages` object[], required
    - `package` string, required
    - `platform` string, required
    - `name` string, required
    - `purl` string, required
    - `recommendation` 'ignore' | 'upgrade' | 'upgrade_or_workaround', required
    - `recommendation_details` object, nullable, required
      - `id` string, required
      - `created_at` string, date-time, required
      - `updated_at` string, date-time, required
      - `impact_score` integer, nullable, required — When using this package as intended, how likely are users to be affected? A general score out of 10.
      - `impact_description` string, nullable, required — Detailed explanation of the impact score.
      - `includes_dev` boolean, nullable, required — Does this vulnerability apply when the package is only used within a Development or CI environment?
      - `other_conditions` boolean, nullable, required — Are there any other conditions that users should check for to determine if they're vulnerable?
      - `other_conditions_description` string, nullable, required — Detailed explanation of the other conditions result.
      - `workaround_available` boolean, nullable, required — For users who are unable to upgrade to a supported release, is there a workaround available?
      - `workaround_description` string, nullable, required — Detailed explanation of the workaround.
      - `specific_methods_affected` boolean, nullable, required — Does this vulnerability apply only if certain methods, classes, or functionality are in use?
      - `specific_methods_description` string, nullable, required — Detailed explanation of the specific methods result.
      - `real_issue` boolean, required — Is this a real vulnerability or a false positive?
      - `false_positive_reason` string, nullable, required — Detailed explanation of the false positive result.
    - `affected_versions` string[]
    - `unaffected_versions` string, nullable, required

## Other responses

- `404` — Record Not Found

---

[API](https://skmtc.net/tidelift/apis/tidelift-external-api.md) · [All operations](https://skmtc.net/tidelift/apis/tidelift-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tidelift/tidelift-external-api/revisions/5f36bed372bb/schema)