---
title: "GET /packages/{package_slug_perm}/vulnerabilities/"
method: GET
path: "/packages/{package_slug_perm}/vulnerabilities/"
tags: ["packages"]
---

# GET /packages/{package_slug_perm}/vulnerabilities/

`GET /packages/{package_slug_perm}/vulnerabilities/`

OSV advisory data for a specific package.

## Path parameters

- `package_slug_perm` string, required

## Query parameters

- `cvss_max` number, double
- `cvss_min` number, double
- `is_malware` boolean, nullable
- `page` integer
- `page_size` integer
- `primary_records` boolean
- `threat_level` 'critical' | 'high' | 'important' | 'low' | 'malware' | 'medium' | 'moderate' | 'negligible' | 'none' | 'unimportant' | 'unknown'
- `vulnerability_id` string

## Response `200`

- PaginatedWebOSVVulnerabilityList
  - `results` WebOSVVulnerability[], required
    - `affected` WebOSVAffected[], nullable, required
      - `database_specific` unknown
      - `ecosystem_specific` unknown
      - `package` PolicyOSVPackage, required — Identifies the affected code library or command provided by the package. The OSV package field is described in detail at https://ossf.github.io/osv-schema/#affectedpackage-field.
        - `ecosystem` string, required — The overall library ecosystem which package belongs to.
        - `name` string, required — The library within the overall ecosystem. Note that the semantics of this field depend on the ecosystem.
        - `purl` string, nullable, required — A string following the Package URL specification that identifies the package, without the @version component.
      - `ranges` unknown
      - `severity` WebOSVSeverity[], nullable, required
        - `type` 'Ubuntu' | 'CVSS_V2' | 'CVSS_V3' | 'CVSS_V4' | 'OTHER', required — * `Ubuntu` - An "Ubuntu" severity type indicates that the associated score is a lowercased string representing the Ubuntu priority. If a severity has this type, the associated "score" will be one of "negligible", "low", "medium", "high", or "critical". See https://ubuntu.com/security/cves/about#priority for more information. * `CVSS_V2` - A "CVSS_V2" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is == 2.0 (e.g."AV:L/AC:M/Au:N/C:N/I:P/A:C"). * `CVSS_V3` - A "CVSS_V3" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 3.0 and < 4.0 (e.g."CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"). * `CVSS_V4` - A "CVSS_V4" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 4.0 and < 5.0 (e.g. "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"). * `OTHER` - A vendor-issued severity extracted from the OSV record.
        - `cvss` WebOSVCvss, required — Parsed CVSS details extracted from a CVSS severity entry.
          - `vector` string, nullable — The original CVSS vector string.
          - `base_score` number, double, nullable — The numerical CVSS base score.
          - `version` string, nullable — The CVSS version (e.g. '2.0', '3.0', '3.1', '4.0').
          - `groups` unknown[], nullable — Parsed metric groups for display.
            - unknown
        - `label` string, required — Normalized severity label derived from the CVSS vector or vendor-provided label (e.g. 'critical', 'high', 'medium', 'low').
        - `raw_label` string, nullable, required — The original severity label as provided in the OSV data, included only when it differs from the normalized label.
      - `versions` string[], nullable
    - `aliases` string[], nullable — A list of IDs of the same vulnerability in other databases. This allows one database to claim that its own entry describes the same vulnerability as one or more entries in other databases. Note that the vulnerability IDs referenced here may or may not exist in the overall data set. Aliases should be considered symmetric (if A is an alias of B, then B is an alias of A) and transitive (If A aliases B and B aliases C, then A aliases C).
    - `credits` unknown
    - `database_specific` unknown
    - `details` string, nullable — Additional English textual details about the vulnerability. This field contains CommonMark markdown (a subset of GitHub-Flavored Markdown).
    - `id` string, required
    - `modified` string, date-time, required — The time the osv.dev vulnerability entry was last modified.
    - `published` string, date-time, nullable — The time the entry should be considered to have been published
    - `references` unknown
    - `related` string[], nullable — A list of closely related vulnerabilities, such as a similar but completely different vulnerability or cases that do not satisfy the strict definition of aliases or upstream. Related vulnerabilities are symmetric but not transitive.
    - `schema_version` string, nullable — The version of the OSV schema a particular vulnerability was exported with. The value should be a string matching the OSV Schema version, which follows the SemVer 2.0.0 format, with no leading “v” prefix. If no value is specified, it should be assumed to be 1.0.0, matching version 1.0 of the OSV Schema.
    - `severity` WebOSVSeverity[], nullable, required
      - `type` 'Ubuntu' | 'CVSS_V2' | 'CVSS_V3' | 'CVSS_V4' | 'OTHER', required — * `Ubuntu` - An "Ubuntu" severity type indicates that the associated score is a lowercased string representing the Ubuntu priority. If a severity has this type, the associated "score" will be one of "negligible", "low", "medium", "high", or "critical". See https://ubuntu.com/security/cves/about#priority for more information. * `CVSS_V2` - A "CVSS_V2" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is == 2.0 (e.g."AV:L/AC:M/Au:N/C:N/I:P/A:C"). * `CVSS_V3` - A "CVSS_V3" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 3.0 and < 4.0 (e.g."CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"). * `CVSS_V4` - A "CVSS_V4" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 4.0 and < 5.0 (e.g. "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"). * `OTHER` - A vendor-issued severity extracted from the OSV record.
      - `cvss` WebOSVCvss, required — Parsed CVSS details extracted from a CVSS severity entry.
        - `vector` string, nullable — The original CVSS vector string.
        - `base_score` number, double, nullable — The numerical CVSS base score.
        - `version` string, nullable — The CVSS version (e.g. '2.0', '3.0', '3.1', '4.0').
        - `groups` unknown[], nullable — Parsed metric groups for display.
          - unknown
      - `label` string, required — Normalized severity label derived from the CVSS vector or vendor-provided label (e.g. 'critical', 'high', 'medium', 'low').
      - `raw_label` string, nullable, required — The original severity label as provided in the OSV data, included only when it differs from the normalized label.
    - `summary` string, nullable — A one-line, English textual summary of the vulnerability. It is recommended that this field be kept short, on the order of no more than 120 characters.
    - `upstream` string[], nullable — A list of IDs of upstream vulnerabilities that are referred to by the vulnerability entry. For example, a downstream package ecosystem (such as a Linux distribution) may issue its own advisories that include (possibly multiple) upstream vulnerabilities. Upstream should be considered transitive but not symmetric.
    - `withdrawn` string, date-time, nullable — The time the entry should be considered to have been withdrawn. If the field is missing, then the entry has not been withdrawn. Any rationale for why the vulnerability has been withdrawn should go into the summary text.
    - `vulnerability_id` string, required — The vulnerability identifier (alias for 'id' field).
    - `cve_id` string, nullable, required — The CVE identifier for the vulnerability, if it exists.
    - `title` string, nullable, required — The vulnerability title (alias for 'summary' field).
    - `source` string, nullable, required — The source database of the vulnerability, extracted from the vulnerability ID prefix (e.g., 'GHSA', 'CVE', 'PYSEC', 'MAL').
    - `source_name` string, nullable, required — The full name of the source database (e.g., 'GitHub Security Advisory Database', 'National Vulnerability Database').
    - `purl` string, nullable, required — The Package URL (purl) of the first affected package, if available.
    - `package_name` string, nullable, required — The name of the first affected package, if available.
    - `best_severity` object, nullable, required — The highest-version severity score available, preferring affected object > severity object, then preferring CVSS V4 > V3.1 > V3 > V2 > vendor severity.
    - `highest_severity` object, nullable, required — The severity with the highest numerical score or label across all affected entries and the vulnerability.
    - `is_malware` boolean, required — Whether this vulnerability is classified as malware (MAL- prefix or CWE-506).

## Changes

> 13 revisions in range; 1 could not be searched.

- **2026-08-12** `44c2d99853e0` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/cloudsmith/apis/cloudsmith-api/changes/packages/:package_slug_perm/vulnerabilities/get.md)

---

[API](https://skmtc.dev/cloudsmith/apis/cloudsmith-api.md) · [All operations](https://skmtc.dev/cloudsmith/apis/cloudsmith-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api/revisions/0d6c8fe92b9f/schema)