For AI agents

Security advisories and CVEs for AI and data open-source projects (every repos.fru.dev project with an advisory, growing daily), from OSV and the GitHub Advisory Database: severity, CVSS score, affected and fixed versions, each linked to its source.

Refreshed every day at 07:15 UTC

Point your agent here

Summary for language modelshttps://advisories.fru.dev/llms.txt
Full data as plain texthttps://advisories.fru.dev/llms-full.txt
OpenAPI 3.1 spec (load as tools)https://advisories.fru.dev/openapi.json

Call the API

MethodPathParamsReturns

GETGET /api/advisoriesproduct?, severity?, ecosystem?, period?, q?, limit?, offset?advisories with id (GHSA), CVE and aliases, a short title (derived once from the record, e.g. "ServiceNow AI Platform: missing authorization"), summary, severity, CVSS score, package, the affected product (productLabel), fixed versions (fixFirst, fixedN), dates and the source URL, plus the total
GETGET /api/advisories/{id}idthe advisory and up to 6 related advisories of the same package
GETGET /api/packageslimit?, offset?packages with id, name, category, the ecosystem packages, advisory counts, latest date, GitHub repo and company
GETGET /api/companiessince?, limit?, offset?companies with slug (companies.fru.dev), name, domain, projects and advisory count; with since: slug, name, domain, url, projects, advisories, updated_at and items (date, type, severity, score, title, id, cve, url, source_url)
GETGET /api/changessince?, limit?changes with advisory id, field, old and new value, time and source URL, newest first
GETGET /api/searchq, limit?up to 20 ranked results with title, link and one line

GET/api/advisories

Advisories, newest first, filtered by package, severity, ecosystem, period or words

productPackage (project) id, e.g. vllm, langchain, mlflow; list them with list_packages
severitySeverity
ecosystemPackage ecosystem
periodPublished in a year (YYYY) or month (YYYY-MM)
qWords in the summary, or an advisory, CVE or alias id
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/advisories?product=vllm&severity=critical&limit=2"

Sample response

JSON

{
  "advisories": [
    {
      "id": "GHSA-94f4-hr76-p5j6",
      "cve": "CVE-2026-48746",
      "aliases": [
        "CVE-2026-48746",
        "PYSEC-2026-226"
      ],
      "summary": "vLLM: OpenAI auth bypass",
      "title": "vLLM: OpenAI auth bypass",
      "severity": "critical",
      "score": 9.1,
      "product": "vllm",
      "productLabel": "",
      "products": [
        "vllm"
      ],
      "fixed": "0.22.0",
      "fixFirst": "0.22.0",
      "fixedN": 1,
      "published": "2026-06-16"
    },
    {
      "id": "GHSA-4r2x-xpjr-7cvv",
      "cve": "CVE-2026-22778",
      "aliases": [
        "CVE-2026-22778",
        "PYSEC-2026-565"
      ],
      "summary": "vLLM has RCE In Video Processing",
      "title": "vLLM has RCE In Video Processing",
      "severity": "critical",
      "score": 9.8,
      "product": "vllm",
      "productLabel": "",
      "products": [
        "vllm"
      ],
      "fixed": "0.14.1",
      "fixFirst": "0.14.1",
      "fixedN": 1,
      "published": "2026-02-02"
    }
  ],
  "total": 9,
  "limit": 2,
  "offset": 0,
  "next": "/api/advisories?product=vllm&severity=critical&limit=2&offset=2"
}

GET/api/advisories/{id}

One advisory in full: affected version ranges per package, CVSS vector, CWEs, references and its change history

idGHSA id, or a CVE, PYSEC or GO alias

Shell

curl -s "https://advisories.fru.dev/api/advisories/GHSA-2pc9-4j83-qjmr"

Sample response

JSON

{
  "advisory": {
    "id": "GHSA-2pc9-4j83-qjmr",
    "cve": "CVE-2026-22807",
    "aliases": [
      "CVE-2026-22807",
      "PYSEC-2026-2010"
    ],
    "summary": "vLLM affected by RCE via auto_map dynamic module loading during model initialization",
    "title": "vLLM affected by RCE via auto_map dynamic module loading during model initialization",
    "severity": "high",
    "score": 8.8,
    "product": "vllm",
    "productLabel": "",
    "products": [
      "vllm"
    ],
    "fixed": "0.14.0",
    "fixFirst": "0.14.0",
    "fixedN": 1,
    "published": "2026-01-21"
  },
  "related": [
    {
      "id": "GHSA-v359-jj2v-j536",
      "cve": "CVE-2026-25960",
      "aliases": [
        "CVE-2026-25960",
        "PYSEC-2026-3411"
      ],
      "summary": "vLLM has SSRF Protection Bypass",
      "title": "vLLM has SSRF Protection Bypass",
      "severity": "medium",
      "score": 5.4,
      "product": "vllm",
      "productLabel": "",
      "products": [
        "vllm"
      ],
      "fixed": "0.17.0",
      "fixFirst": "0.17.0",
      "fixedN": 1,
      "published": "2026-03-09"
    },
    {
      "id": "GHSA-4r2x-xpjr-7cvv",
      "cve": "CVE-2026-22778",
      "aliases": [
        "CVE-2026-22778",
        "PYSEC-2026-565"
      ],
      "summary": "vLLM has RCE In Video Processing",
      "title": "vLLM has RCE In Video Processing",
      "severity": "critical",
      "score": 9.8,
      "product": "vllm",
      "productLabel": "",
      "products": [
        "vllm"
      ],
      "fixed": "0.14.1",
      "fixFirst": "0.14.1",
      "fixedN": 1,
      "published": "2026-02-02"
    }
  ]
}

GET/api/packages

Every project covered, most advisories first

limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/packages?limit=2"

Sample response

JSON

{
  "packages": [
    {
      "id": "oracle",
      "name": "Oracle",
      "category": "Vendor advisories",
      "packages": [],
      "advisories": 2633,
      "criticalOrHighLast12Months": 1995,
      "latest": "2026-09-15",
      "repo": "",
      "reposPage": null,
      "company": {
        "slug": "oracle",
        "profile": "https://companies.fru.dev/companies/oracle"
      },
      "page": "https://advisories.fru.dev/packages/oracle"
    },
    {
      "id": "microsoft",
      "name": "Microsoft",
      "category": "Vendor advisories",
      "packages": [],
      "advisories": 2149,
      "criticalOrHighLast12Months": 1579,
      "latest": "2026-09-25",
      "repo": "",
      "reposPage": null,
      "company": {
        "slug": "microsoft",
        "profile": "https://companies.fru.dev/companies/microsoft"
      },
      "page": "https://advisories.fru.dev/packages/microsoft"
    }
  ],
  "total": 277,
  "limit": 2,
  "offset": 0,
  "next": "/api/packages?limit=2&offset=2"
}

GET/api/companies

Companies behind the projects; with since, the registry feed of companies with new advisories

sinceISO date (YYYY-MM-DD) or datetime: only companies with advisories published or found since then, each with those advisories
limitItems per page, 1 to 200
offsetItems to skip, for the next page

Shell

curl -s "https://advisories.fru.dev/api/companies?limit=2"

Sample response

JSON

{
  "companies": [
    {
      "id": "oracle",
      "slug": "oracle",
      "name": "Oracle",
      "domain": "oracle.com",
      "parent_slug": "",
      "projects": [
        "oracle"
      ],
      "advisories": 2633,
      "latest": "2026-09-15",
      "page": "https://advisories.fru.dev/companies/oracle",
      "profile": "https://companies.fru.dev/companies/oracle"
    },
    {
      "id": "microsoft",
      "slug": "microsoft",
      "name": "Microsoft",
      "domain": "microsoft.com",
      "parent_slug": "",
      "projects": [
        "semantic-kernel",
        "deepspeed"
      ],
      "advisories": 2153,
      "latest": "2026-09-25",
      "page": "https://advisories.fru.dev/companies/microsoft",
      "profile": "https://companies.fru.dev/companies/microsoft"
    }
  ],
  "total": 140,
  "limit": 2,
  "offset": 0,
  "next": "/api/companies?limit=2&offset=2"
}

GET/api/changes

Changes to advisories after they were first listed: severity, score, summary, fixed versions, withdrawals

sinceISO date (YYYY-MM-DD) or datetime
limitItems, 1 to 500

Shell

curl -s "https://advisories.fru.dev/api/changes?limit=2"

Sample response

JSON

{
  "changes": [
    {
      "id": 43,
      "advisory": "AWS-2026-045",
      "field": "severity",
      "old": "unknown",
      "new": "medium",
      "at": "2026-09-26 02:05:43",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11931",
      "summary": "Insecure Permissions on Authentication Token Cache File in Kiro IDE",
      "title": "Insecure Permissions on Authentication Token Cache File in Kiro IDE",
      "product": "aws",
      "page": "https://advisories.fru.dev/advisories/AWS-2026-045"
    },
    {
      "id": 42,
      "advisory": "AWS-2026-049",
      "field": "severity",
      "old": "unknown",
      "new": "medium",
      "at": "2026-09-26 02:05:36",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13769",
      "summary": "CVE-2026-13769 – Insecure file permissions in AWS CLI",
      "title": "Insecure file permissions in AWS CLI",
      "product": "aws",
      "page": "https://advisories.fru.dev/advisories/AWS-2026-049"
    }
  ],
  "since": null
}

GET/api/search

Search packages, advisories, CVE ids and pages

qPackage, CVE or words
limitResults, 1 to 20

Shell

curl -s "https://advisories.fru.dev/api/search?q=langchain&limit=3"

Sample response

JSON

{
  "q": "langchain",
  "results": [
    {
      "id": "pk:langchain",
      "group": "companies",
      "title": "LangChain",
      "subtitle": "45 advisories · Agents and LLM apps",
      "href": "/packages/langchain",
      "keywords": [
        "langchain",
        "langchain"
      ],
      "logo": "https://advisories.fru.dev/api/logo?domain=langchain.com&size=64",
      "score": 1050
    },
    {
      "id": "co:langchain",
      "group": "pages",
      "title": "LangChain",
      "subtitle": "Company · 2 projects",
      "href": "/companies/langchain",
      "keywords": [
        "langchain.com"
      ],
      "logo": "/api/logo?domain=langchain.com&size=64",
      "score": 1000
    }
  ]
}

Add to your agent

System prompt

For security advisories and CVEs in AI and data open-source projects (vLLM, Ollama, LangChain, PyTorch, MLflow, Airflow, Spark and more), fetch https://advisories.fru.dev/llms.txt and use https://advisories.fru.dev/api/advisories (spec: https://advisories.fru.dev/openapi.json). Cite "Advisories (advisories.fru.dev)" with a link.

Usage terms

Free to read, no key needed
Cite "Advisories (advisories.fru.dev)" with a link
Responses are cached; refreshed every day at 07:15 UTC
Keep to 60 requests a minute or fewer