---
title: "List CVEs with fleet-wide customer and release impact counts. CVEs come from each reported release's recorded image inventory. Counts include only exact latest reported-release memberships visible to the caller; instances without a resolved reported release are not inferred."
method: GET
path: "/app/{app_id}/security/customer-impact/cves"
tags: ["customers"]
---

# List CVEs with fleet-wide customer and release impact counts. CVEs come from each reported release's recorded image inventory. Counts include only exact latest reported-release memberships visible to the caller; instances without a resolved reported release are not inferred.

`GET /app/{app_id}/security/customer-impact/cves`

## Request

- Base URL: `https://api.replicated.com/vendor/v3`
- URL: `https://api.replicated.com/vendor/v3/app/{app_id}/security/customer-impact/cves`
- Auth: API key in header `Authorization`

Required RBAC Policies: kots/app/[:appid]/read and
kots/app/[:appid]/license/[:licenseid]/read

## Path parameters

- `app_id` string, required

## Query parameters

- `pageSize` integer
- `currentPage` integer
- `search` string
- `severity` string
- `includeUnfixable` boolean

## Response `200`

- object
  - `cves` SecurityCustomerImpactCVE[]
    - `affectedReleases` integer
    - `customerCount` integer
    - `cveId` string
    - `description` string
    - `severity` string
  - `scanCoverage` SecurityCustomerImpactCVEScanCoverage
    - `completed` integer
    - `incomplete` integer
    - `total` integer
  - `severityCounts` SeverityCounts: SeverityCounts is the four-severity CVE count projection returned by the customer-impact APIs (securebuild VulnCounts without Total).
    - `critical` integer
    - `high` integer
    - `low` integer
    - `medium` integer
  - `totalCVEs` integer

## Other responses

- `400`: Returned on bad input
- `401`: Return if the caller is not authorized
- `403`: Returned if the caller does not have the needed permission
- `404`: Returned on resource not found

## Changes

- **2026-11-03** `a36c6aead22f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/replicated/apis/vendor-api-v3-2/changes/app/:app_id/security/customer-impact/cves/get.md)

---

[API](https://skmtc.dev/replicated/apis/vendor-api-v3-2.md) - [All operations](https://skmtc.dev/replicated/apis/vendor-api-v3-2/llms.txt) - [OpenAPI document](https://skmtc.dev/replicated/apis/vendor-api-v3-2/revisions/a36c6aead22f?raw)