CVEs affecting one open-source package (ranges verbatim)
CVE list for a package, KEV-first, with each OSV version range verbatim: events plus one render-safe projection per range, fixed (the upgrade targets) or affected_through (the last vulnerable version, so upgrade past it). No version-membership evaluation is performed server-side; compare versions with your ecosystem's own semantics. {ecosystem} is the purl type (npm, pypi, maven, golang, cargo, composer, gem, nuget, …) or the OSV display name; {name} is the package name and may itself contain slashes (@scope/name, Go module paths, composer vendor/name, percent-encoding optional) or a Maven group:artifact. Alternatively pass ?purl=pkg:npm/lodash and any path is ignored. Covers CVE-linked, GitHub-reviewed OSS advisories via OSV.dev; absence is not evidence of safety. Keyless twin: MCP tool query_package.
Request
- Base URL: https://cve-security.com
- URL: https://cve-security.com/api/package/{ecosystem}/{name}
- Auth: one of:
- HTTP bearer
- API key in header X-API-Key
Path parameters
Query parameters
Response
package{ecosystem,name,purl,key}, cve_count, cves[]{cve_id, url, title, severity, cvss, epss, cisa_kev, known_ransomware_use, published, advisory, advisory_url, ranges[]{type, events, fixed?|affected_through?}}, _meta{source, attribution, absence_semantics}.
Changes
No recorded changes to this operation across all 1 revision of this API.