For AI agents

Security advisories and CVEs for about 70 AI and data projects, from OSV and the GitHub Advisory Database: severity, CVSS score, affected and fixed versions, each linked to its source.

Refreshed every day at 07:15 UTC

Point your agent here

Summary for language modelshttps://advisories.fru.dev/llms.txt
Full data as plain texthttps://advisories.fru.dev/llms-full.txt
OpenAPI 3.1 spec (load as tools)https://advisories.fru.dev/openapi.json

Call the API

MethodPathParamsReturns

GETGET /api/advisoriesproduct?, severity?, ecosystem?, period?, q?, limit?, offset?advisories with id (GHSA), CVE and aliases, summary, severity, CVSS score, package, fixed versions, dates and the source URL, plus the total
GETGET /api/advisories/{id}idthe advisory and up to 6 related advisories of the same package
GETGET /api/packageslimit?, offset?packages with id, name, category, the ecosystem packages, advisory counts, latest date, GitHub repo and company
GETGET /api/companiessince?, limit?, offset?companies with slug (companies.fru.dev), name, domain, projects and advisory count; with since: slug, name, domain, url, projects, advisories, updated_at and items (date, type, severity, score, title, id, cve, url, source_url)
GETGET /api/changessince?, limit?changes with advisory id, field, old and new value, time and source URL, newest first
GETGET /api/searchq, limit?up to 20 ranked results with title, link and one line

GET/api/advisories

Advisories, newest first, filtered by package, severity, ecosystem, period or words

productPackage (project) id, e.g. vllm, langchain, mlflow; list them with list_packages
severitySeverity
ecosystemPackage ecosystem
periodPublished in a year (YYYY) or month (YYYY-MM)
qWords in the summary, or an advisory, CVE or alias id
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/advisories?product=vllm&severity=critical&limit=2"

Sample response

JSON

{
  "advisories": [
    {
      "id": "GHSA-94f4-hr76-p5j6",
      "cve": "CVE-2026-48746",
      "aliases": [
        "CVE-2026-48746",
        "PYSEC-2026-226"
      ],
      "summary": "vLLM: OpenAI auth bypass",
      "severity": "critical",
      "score": 9.1,
      "product": "vllm",
      "products": [
        "vllm"
      ],
      "fixed": "0.22.0",
      "published": "2026-06-16",
      "modified": "2026-09-10",
      "withdrawn": "",
      "url": "https://github.com/advisories/GHSA-94f4-hr76-p5j6",
      "foundAt": "2026-09-24 22:37:49"
    },
    {
      "id": "GHSA-4r2x-xpjr-7cvv",
      "cve": "CVE-2026-22778",
      "aliases": [
        "CVE-2026-22778",
        "PYSEC-2026-565"
      ],
      "summary": "vLLM has RCE In Video Processing",
      "severity": "critical",
      "score": 9.8,
      "product": "vllm",
      "products": [
        "vllm"
      ],
      "fixed": "0.14.1",
      "published": "2026-02-02",
      "modified": "2026-09-10",
      "withdrawn": "",
      "url": "https://github.com/advisories/GHSA-4r2x-xpjr-7cvv",
      "foundAt": "2026-09-24 22:37:49"
    }
  ],
  "total": 9,
  "limit": 2,
  "offset": 0,
  "next": "/api/advisories?product=vllm&severity=critical&limit=2&offset=2"
}

GET/api/advisories/{id}

One advisory in full: affected version ranges per package, CVSS vector, CWEs, references and its change history

idGHSA id, or a CVE, PYSEC or GO alias

Shell

curl -s "https://advisories.fru.dev/api/advisories/GHSA-2pc9-4j83-qjmr"

Sample response

JSON

{
  "advisory": {
    "id": "GHSA-2pc9-4j83-qjmr",
    "cve": "CVE-2026-22807",
    "aliases": [
      "CVE-2026-22807",
      "PYSEC-2026-2010"
    ],
    "summary": "vLLM affected by RCE via auto_map dynamic module loading during model initialization",
    "severity": "high",
    "score": 8.8,
    "product": "vllm",
    "products": [
      "vllm"
    ],
    "fixed": "0.14.0",
    "published": "2026-01-21",
    "modified": "2026-09-10",
    "withdrawn": "",
    "url": "https://github.com/advisories/GHSA-2pc9-4j83-qjmr",
    "foundAt": "2026-09-24 22:37:49"
  },
  "related": [
    {
      "id": "GHSA-grg2-63fw-f2qr",
      "cve": "CVE-2026-22773",
      "aliases": [
        "CVE-2026-22773",
        "PYSEC-2026-143"
      ],
      "summary": "vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions",
      "severity": "medium",
      "score": 6.5,
      "product": "vllm",
      "products": [
        "vllm"
      ],
      "fixed": "0.12.0",
      "published": "2026-01-13",
      "modified": "2026-09-10",
      "withdrawn": "",
      "url": "https://github.com/advisories/GHSA-grg2-63fw-f2qr",
      "foundAt": "2026-09-24 22:37:49"
    },
    {
      "id": "GHSA-qh4c-xf7m-gxfc",
      "cve": "CVE-2026-24779",
      "aliases": [
        "CVE-2026-24779",
        "PYSEC-2026-2020"
      ],
      "summary": "vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector",
      "severity": "high",
      "score": 7.1,
      "product": "vllm",
      "products": [
        "vllm"
      ],
      "fixed": "0.14.1",
      "published": "2026-01-28",
      "modified": "2026-09-10",
      "withdrawn": "",
      "url": "https://github.com/advisories/GHSA-qh4c-xf7m-gxfc",
      "foundAt": "2026-09-24 22:37:49"
    }
  ]
}

GET/api/packages

Every project covered, most advisories first

limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/packages?limit=2"

Sample response

JSON

{
  "packages": [
    {
      "id": "tensorflow",
      "name": "TensorFlow",
      "category": "ML frameworks",
      "packages": [
        {
          "ecosystem": "PyPI",
          "name": "tensorflow",
          "registry": "https://pypi.org/project/tensorflow/"
        }
      ],
      "advisories": 433,
      "criticalOrHighLast12Months": 0,
      "latest": "2024-07-30",
      "repo": "https://github.com/tensorflow/tensorflow",
      "reposPage": "https://repos.fru.dev/projects/tensorflow",
      "company": {
        "slug": "google",
        "profile": "https://companies.fru.dev/companies/google"
      },
      "page": "https://advisories.fru.dev/packages/tensorflow"
    },
    {
      "id": "open-webui",
      "name": "Open WebUI",
      "category": "Agents and LLM apps",
      "packages": [
        {
          "ecosystem": "PyPI",
          "name": "open-webui",
          "registry": "https://pypi.org/project/open-webui/"
        }
      ],
      "advisories": 161,
      "criticalOrHighLast12Months": 65,
      "latest": "2026-09-10",
      "repo": "https://github.com/open-webui/open-webui",
      "reposPage": null,
      "company": null,
      "page": "https://advisories.fru.dev/packages/open-webui"
    }
  ],
  "total": 70,
  "limit": 2,
  "offset": 0,
  "next": "/api/packages?limit=2&offset=2"
}

GET/api/companies

Companies behind the projects; with since, the registry feed of companies with new advisories

sinceISO date (YYYY-MM-DD) or datetime: only companies with advisories published or found since then, each with those advisories
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/companies?limit=2"

Sample response

JSON

{
  "companies": [
    {
      "id": "google",
      "slug": "google",
      "name": "Google",
      "domain": "google.com",
      "projects": [
        "tensorflow",
        "keras"
      ],
      "advisories": 453,
      "latest": "2026-08-10",
      "page": "https://advisories.fru.dev/companies/google",
      "profile": "https://companies.fru.dev/companies/google"
    },
    {
      "id": "n8n",
      "slug": "n8n",
      "name": "n8n",
      "domain": "n8n.io",
      "projects": [
        "n8n"
      ],
      "advisories": 156,
      "latest": "2026-09-10",
      "page": "https://advisories.fru.dev/companies/n8n",
      "profile": "https://companies.fru.dev/companies/n8n"
    }
  ],
  "total": 29,
  "limit": 2,
  "offset": 0,
  "next": "/api/companies?limit=2&offset=2"
}

GET/api/changes

Changes to advisories after they were first listed: severity, score, summary, fixed versions, withdrawals

sinceISO date (YYYY-MM-DD) or datetime
limitItems, 1 to 500

Shell

curl -s "https://advisories.fru.dev/api/changes?limit=2"

Sample response

JSON

{
  "changes": [
    {
      "id": 3,
      "advisory": "PYSEC-2025-197",
      "field": "severity",
      "old": "unknown",
      "new": "low",
      "at": "2026-09-24 22:38:04",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3136",
      "summary": "A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory....",
      "product": "pytorch",
      "page": "https://advisories.fru.dev/advisories/PYSEC-2025-197"
    },
    {
      "id": 2,
      "advisory": "PYSEC-2026-2179",
      "field": "severity",
      "old": "unknown",
      "new": "high",
      "at": "2026-09-24 22:37:57",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49119",
      "summary": "Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticat...",
      "product": "gradio",
      "page": "https://advisories.fru.dev/advisories/PYSEC-2026-2179"
    }
  ],
  "since": null
}

GET/api/search

Search packages, advisories, CVE ids and pages

qPackage, CVE or words
limitResults, 1 to 20

Shell

curl -s "https://advisories.fru.dev/api/search?q=langchain&limit=3"

Sample response

JSON

{
  "q": "langchain",
  "results": [
    {
      "id": "pk:langchain",
      "group": "companies",
      "title": "LangChain",
      "subtitle": "45 advisories · Agents and LLM apps",
      "href": "/packages/langchain",
      "keywords": [
        "langchain",
        "langchain"
      ],
      "logo": "https://img.logo.dev/langchain.com?token=...&retina=true&format=png&theme=light&size=64&fallback=404",
      "score": 1050
    },
    {
      "id": "co:langchain",
      "group": "pages",
      "title": "LangChain",
      "subtitle": "Company · 2 projects",
      "href": "/companies/langchain",
      "keywords": [
        "langchain.com"
      ],
      "logo": "https://img.logo.dev/langchain.com?token=...&retina=true&format=png&theme=light&size=64&fallback=404",
      "score": 1000
    }
  ]
}

Add to your agent

System prompt

For security advisories and CVEs in AI and data open-source projects (vLLM, Ollama, LangChain, PyTorch, MLflow, Airflow, Spark and more), fetch https://advisories.fru.dev/llms.txt and use https://advisories.fru.dev/api/advisories (spec: https://advisories.fru.dev/openapi.json). Cite "Advisories (advisories.fru.dev)" with a link.

Usage terms

Free to read, no key needed
Cite "Advisories (advisories.fru.dev)" with a link
Responses are cached; refreshed every day at 07:15 UTC
Keep to 60 requests a minute or fewer

For AI agents

Point your agent here

Call the API

GET/api/advisories

GET/api/advisories/{id}

GET/api/packages

GET/api/companies

GET/api/changes

GET/api/search

Add to your agent

Usage terms

Critical advisories by email