---
title: "Check Vulnerabilities"
method: GET
path: "/check/vulnerabilities"
tags: ["check"]
---

# Check Vulnerabilities

`GET /check/vulnerabilities`

Get known open ports and CVEs for an IP address. `vulnerabilities` is the
raw Shodan InternetDB payload
(`cpes` / `hostnames` / `ip` / `ports` / `tags` / `vulns`), or `null`.

## Query parameters

- `query` string

## Response `200`

Vulnerabilities data response: `{"vulnerabilities": <raw Shodan InternetDB payload> | null}`

- VulnerabilitiesResponse
  - `vulnerabilities` object, nullable

## Other responses

- `400` — Missing query parameter
- `401` — Unauthorized - Missing or invalid API key
- `429` — Too many requests - Rate limit exceeded

## Changes

- **2026-08-31** `9d9ef31d83e5` — 14 breaking, 2 warning, 1 info
  - the response property `message` became nullable for the status `400`
  - the response property `message` became nullable for the status `401`
  - the response property `message` became nullable for the status `429`
  - the response property `vulnerabilities` became nullable for the status `200`
  - …13 more
- **2026-08-30** `aa5294fdc8d8` — 1 warning
  - deleted the `path` request parameter `track_reports`

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/check/vulnerabilities/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/edb544398108?raw)