---
title: "Get session vulnerabilities"
method: GET
path: "/session/{sessionID}/vulnerability"
---

# Get session vulnerabilities

`GET /session/{sessionID}/vulnerability`

Retrieve the list of vulnerabilities reported for a specific session.

## Path parameters

- `sessionID` string, required

## Query parameters

- `directory` string

## Response `200`

Vulnerability list

- Vulnerability[]
  - `id` string
  - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info', required
  - `title` string, required
  - `description` string, required
  - `cwe_id` string
  - `file` string
  - `line_start` integer
  - `line_end` integer
  - `steps_to_reproduce` string
  - `business_impact` string
  - `recommendation` string
  - `poc` string
  - `endpoint` string
  - `attack_vector` string
  - `status` 'new' | 'approved' | 'duplicate' | 'open' | 'fixed' | 'ignored'
  - `candidate` 'critical' | 'high' | 'medium' | 'low' | 'info'
  - `duplicate_of` string
  - `message_id` string
  - `time` object
    - `created` number, required
    - `updated` number, required

## Other responses

- `400` — Bad request
- `404` — Not found

## Changes

- **2026-08-06** `4e11f1aed2fd` — 1 info
  - added the optional property `items/candidate` to the response with the `200` status
- **2026-06-29** `e7837fb0de8f` — 3 warning, 2 info
  - added the new `approved` enum value to the `items/status` response property for the response status `200`
  - added the new `duplicate` enum value to the `items/status` response property for the response status `200`
  - added the new `new` enum value to the `items/status` response property for the response status `200`
  - added the optional property `items/duplicate_of` to the response with the `200` status
  - …1 more
- **2026-05-06** `e0c4f07da7b4` — 2 info
  - added the optional property `items/attack_vector` to the response with the `200` status
  - added the optional property `items/endpoint` to the response with the `200` status
- **2026-03-17** `437a6ea5aeb3` — 1 info
  - endpoint added
- **2026-01-20** `c7ae6a68e4fb` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/changes/session/:sessionID/vulnerability/get.md)

---

[API](https://skmtc.dev/cyberstrikeus/apis/cyberstrike.md) · [All operations](https://skmtc.dev/cyberstrikeus/apis/cyberstrike/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cyberstrikeus/cyberstrike/revisions/60718ff578c8/schema)