---
title: "List potential vulnerabilities of a vendor"
method: GET
path: "/vulnerabilities/vendor"
tags: ["vulnerabilities"]
---

# List potential vulnerabilities of a vendor

`GET /vulnerabilities/vendor`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/vulnerabilities/vendor`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/vulnerabilities/vendor/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a list of potential vulnerabilities that have been detected for a particular vendor.

Required API key permissions: `VendorRisk` (select when creating API key in Account Settings)

## Query parameters

- `primary_hostname` string, required

## Response `200`

A list of detected potential vendor vulnerabilities

- GetVendorVulnerabilitiesV1RespBody
  - `vulnerabilities` Vulnerability[]: The list of potential vendor vulnerabilities that have been detected.
    - `cpes` string[]: The CPEs (Common Platform Enumeration) of the vulnerability
    - `created_at` string, date-time: The date the potential vulnerability was detected (ISO 3339 format)
    - `cve` Cve: Information about a CVE (Common Vulnerabilities and Exposures) Entry
      - `description` string: The technical description for the vulnerability
      - `epss` number, double: The EPSS (Exploit Prediction Scoring System) score.
      - `id` string: The CVE ID
      - `severity` number, double: The CVSS (Common Vulnerability Scoring System)
    - `hostname` string: The hostname where the potential vulnerability was detected
    - `ip_addresses` string[]: The IP addresses where the potential vulnerability was detected
    - `known_exploited_vulnerability` boolean: Indicates whether the vulnerability is known to be actively exploited
    - `verified` boolean: Indicates if the vulnerability has been tested and verified as part of an automated scan

## Other responses

- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)