GET /packages/{package_slug_perm}/vulnerabilities/

Maximum CVSS score (inclusive). Filters vulnerabilities whose best classified severity has a numerical score <= this value. Use with cvss_min for range filtering.

Minimum CVSS score (inclusive). Filters vulnerabilities whose best classified severity has a numerical score >= this value. Use with cvss_max for range filtering.

Filter by malware classification (MAL- prefix or CWE-506). When true, only malware entries are returned; when false, malware entries are excluded.

A page number within the paginated result set.

Number of results to return per page.

When true (default), only primary vulnerability records are returned, excluding records that describe the same flaw. When false, all matched records are returned including duplicates.

Field to sort by. Prepend - for descending order. severity sorts by threat level, then CVSS score; within each threat level, vulnerabilities without a CVSS score come last when descending and first when ascending. epss sorts by the EPSS score of the vulnerability's CVE (cve_id); vulnerabilities without an EPSS score always come last, and equal scores are ordered most severe first in either direction.

Filter by threat level. Matches the single best classified severity. Accepts normalized threat levels (critical, high, medium, low, unknown, malware) and vendor aliases (important, moderate, negligible, none, unimportant).

• critical - critical
• high - high
• important - important
• low - low
• malware - malware
• medium - medium
• moderate - moderate
• negligible - negligible
• none - none
• unimportant - unimportant
• unknown - unknown

Filter by OSV vulnerability identifier (e.g., CVE-2024-1234 or GHSA-xxxx). Matching is exact and case-sensitive, and also checks the aliases and upstream identifiers of each advisory.