---
title: "Am I affected? — a version or a domain checked against one CVE, without an account. Without `product`/`version`/`domain` it returns the affected products and their branches (the CVE page's picker and « versions per branch » data)."
method: GET
path: "/cve/{id}/affected"
tags: ["cve"]
---

# Am I affected? — a version or a domain checked against one CVE, without an account. Without \`product\`/\`version\`/\`domain\` it returns the affected products and their branches (the CVE page's picker and « versions per branch » data).

`GET /cve/{id}/affected`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/cve/{id}/affected`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

## Path parameters

- `id` string, required

## Query parameters

- `product` string
- `version` string
- `domain` string

## Response `200`

Verdict per product (`affected`, `not_affected`, `unverified`, `not_detected`)

- AffectedCheckResponse
  - `cveId` string, required
  - `notices` SourceNotice[], required: Notices owed by a source behind a verdict or a branch of the answer: VulnCheck's (§12) when `VULNCHECK`/`vulncheck` appears. This check does not read VulnCheck's ranges today (anonymous callers), so it is empty unless that changes.
    - `matchSource` 'NvdCpe' | 'Osv' | 'Csaf' | 'VulnCheck' | 'OpenCve' | 'Legacy' | 'Cna', required: `ExposureFindingComponent.matchSources` entries.
    - `name` string, required: `VulnCheck`.
    - `source` string, required: The source's id in the attribution manifest (`GET /cve/attribution`): `vulncheck`.
    - `termsUrl` string, nullable: The terms that require the notice.
    - `text` string, required: Shown as is: « This product uses data from VulnCheck (https://vulncheck.com). »
    - `url` string, required: The publisher's site.
  - `products` AffectedProduct[], required
    - `branches` BranchDto[], required
      - `affected` string, required
      - `branch` string, required
      - `fixedVersion` string, nullable
      - `sources` string[], required
    - `cpeProduct` string, nullable
    - `cpeVendor` string, nullable
    - `ecosystem` string, nullable
    - `identityKey` string, required
    - `name` string, required
    - `packageName` string, nullable
  - `query` AffectedQueryEcho, required
    - `domain` string, nullable
    - `product` string, nullable
    - `version` string, nullable
  - `readAt` string, date-time, nullable
  - `results` AffectedResult[], required
    - `branch` string, nullable
    - `fixedVersion` string, nullable
    - `identityKey` string, required
    - `matchSources` string[], required
    - `name` string, required
    - `note` string, nullable: `distro_backport`, `branch_only`, `no_version`.
    - `range` string, nullable
    - `verdict` string, required: `affected`, `not_affected`, `unverified`, `not_detected`.
    - `version` string, nullable
    - `versionEvidence` string, nullable

## Other responses

- `400`: Malformed id or parameters
- `404`: No catalogue entry for this id
- `429`: Rate limit exceeded (a new domain read: 30 per hour per organisation, 10 per hour per anonymous address)
- `503`: The limiter or the anonymous live budget is unavailable

## Changes

- **2026-11-01** `e802f56e895a`: 1 info
  - added the required property `notices` to the response with the `200` status
- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/cve/:id/affected/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)