---
title: "Get the vulnerability list."
method: GET
path: "/security/vul"
tags: ["securityhub"]
---

# Get the vulnerability list.

`GET /security/vul`

Get the vulnerability list. use q to pass the query condition,
supported conditions:
cve_id(exact match)
cvss_score_v3(range condition)
severity(exact match)
status(exact match)
repository_name(exact match)
project_id(exact match)
package(exact match)
tag(exact match)
digest(exact match)

## Query parameters

- `q` string
- `page` integer
- `page_size` integer
- `tune_count` boolean
- `with_tag` boolean

## Headers

- `X-Request-Id` string

## Response `200`

The vulnerability list.

- VulnerabilityItem[]
  - `project_id` integer — the project ID of the artifact
  - `repository_name` string — the repository name of the artifact
  - `digest` string — the digest of the artifact
  - `tags` string[] — the tags of the artifact
  - `cve_id` string — the CVE id of the vulnerability.
  - `severity` string — the severity of the vulnerability
  - `status` string — the status of the vulnerability, example "fixed", "won't fix"
  - `cvss_v3_score` number, float — the nvd cvss v3 score of the vulnerability
  - `package` string — the package of the vulnerability
  - `version` string — the version of the package
  - `fixed_version` string — the fixed version of the package
  - `desc` string — The description of the vulnerability
  - `links` string[] — Links of the vulnerability

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `500` — Internal server error

---

[API](https://skmtc.dev/goharbor/apis/harbor-api.md) · [All operations](https://skmtc.dev/goharbor/apis/harbor-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goharbor/harbor-api/revisions/62d78801f8df/schema)