{ "openapi": "3.1.0", "info": { "title": "Advisories API", "version": "1.0.0", "summary": "Security advisories and CVEs for about 70 AI and data projects, from OSV and the GitHub Advisory Database: severity, CVSS score, affected and fixed versions, each linked to its source", "description": "Security advisories and CVEs for about 70 AI and data projects, from OSV and the GitHub Advisory Database: severity, CVSS score, affected and fixed versions, each linked to its source. Refreshed every day at 07:15 UTC. Free to read; please cite \"Advisories (advisories.fru.dev)\" with a link. Responses are cached at the edge; keep to about 60 requests a minute. Guide: https://advisories.fru.dev/agents", "contact": { "name": "fru.dev", "url": "https://fru.dev", "email": "fru.dev3@gmail.com" } }, "externalDocs": { "description": "For AI agents", "url": "https://advisories.fru.dev/agents" }, "servers": [ { "url": "https://advisories.fru.dev" } ], "paths": { "/api/advisories": { "get": { "operationId": "list_advisories", "summary": "Advisories, newest first, filtered by package, severity, ecosystem, period or words", "description": "Advisories, newest first, filtered by package, severity, ecosystem, period or words. Returns advisories with id (GHSA), CVE and aliases, summary, severity, CVSS score, package, fixed versions, dates and the source URL, plus the total.", "parameters": [ { "name": "product", "in": "query", "required": false, "description": "Package (project) id, e.g. vllm, langchain, mlflow; list them with list_packages", "schema": { "type": "string" }, "example": "vllm" }, { "name": "severity", "in": "query", "required": false, "description": "Severity", "schema": { "type": "string", "enum": [ "critical", "high", "medium", "low", "unknown" ] } }, { "name": "ecosystem", "in": "query", "required": false, "description": "Package ecosystem", "schema": { "type": "string", "enum": [ "PyPI", "npm", "Maven", "Go" ] } }, { "name": "period", "in": "query", "required": false, "description": "Published in a year (YYYY) or month (YYYY-MM)", "schema": { "type": "string" }, "example": "2026" }, { "name": "q", "in": "query", "required": false, "description": "Words in the summary, or an advisory, CVE or alias id", "schema": { "type": "string" }, "example": "remote code execution" }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 60 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "advisories with id (GHSA), CVE and aliases, summary, severity, CVSS score, package, fixed versions, dates and the source URL, plus the total", "content": { "application/json": { "schema": { "type": "object" }, "example": { "advisories": [ { "id": "GHSA-94f4-hr76-p5j6", "cve": "CVE-2026-48746", "aliases": [ "CVE-2026-48746", "PYSEC-2026-226" ], "summary": "vLLM: OpenAI auth bypass", "severity": "critical", "score": 9.1, "product": "vllm", "products": [ "vllm" ], "fixed": "0.22.0", "published": "2026-06-16", "modified": "2026-09-10", "withdrawn": "", "url": "https://github.com/advisories/GHSA-94f4-hr76-p5j6", "foundAt": "2026-09-24 22:37:49" }, { "id": "GHSA-4r2x-xpjr-7cvv", "cve": "CVE-2026-22778", "aliases": [ "CVE-2026-22778", "PYSEC-2026-565" ], "summary": "vLLM has RCE In Video Processing", "severity": "critical", "score": 9.8, "product": "vllm", "products": [ "vllm" ], "fixed": "0.14.1", "published": "2026-02-02", "modified": "2026-09-10", "withdrawn": "", "url": "https://github.com/advisories/GHSA-4r2x-xpjr-7cvv", "foundAt": "2026-09-24 22:37:49" } ], "total": 9, "limit": 2, "offset": 0, "next": "/api/advisories?product=vllm&severity=critical&limit=2&offset=2" } } } } } } }, "/api/advisories/{id}": { "get": { "operationId": "get_advisory", "summary": "One advisory in full: affected version ranges per package, CVSS vector, CWEs, references and its change history", "description": "One advisory in full: affected version ranges per package, CVSS vector, CWEs, references and its change history. Returns the advisory and up to 6 related advisories of the same package.", "parameters": [ { "name": "id", "in": "path", "required": true, "description": "GHSA id, or a CVE, PYSEC or GO alias", "schema": { "type": "string" }, "example": "GHSA-2pc9-4j83-qjmr" } ], "responses": { "200": { "description": "the advisory and up to 6 related advisories of the same package", "content": { "application/json": { "schema": { "type": "object" }, "example": { "advisory": { "id": "GHSA-2pc9-4j83-qjmr", "cve": "CVE-2026-22807", "aliases": [ "CVE-2026-22807", "PYSEC-2026-2010" ], "summary": "vLLM affected by RCE via auto_map dynamic module loading during model initialization", "severity": "high", "score": 8.8, "product": "vllm", "products": [ "vllm" ], "fixed": "0.14.0", "published": "2026-01-21", "modified": "2026-09-10", "withdrawn": "", "url": "https://github.com/advisories/GHSA-2pc9-4j83-qjmr", "foundAt": "2026-09-24 22:37:49" }, "related": [ { "id": "GHSA-grg2-63fw-f2qr", "cve": "CVE-2026-22773", "aliases": [ "CVE-2026-22773", "PYSEC-2026-143" ], "summary": "vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions", "severity": "medium", "score": 6.5, "product": "vllm", "products": [ "vllm" ], "fixed": "0.12.0", "published": "2026-01-13", "modified": "2026-09-10", "withdrawn": "", "url": "https://github.com/advisories/GHSA-grg2-63fw-f2qr", "foundAt": "2026-09-24 22:37:49" }, { "id": "GHSA-qh4c-xf7m-gxfc", "cve": "CVE-2026-24779", "aliases": [ "CVE-2026-24779", "PYSEC-2026-2020" ], "summary": "vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector", "severity": "high", "score": 7.1, "product": "vllm", "products": [ "vllm" ], "fixed": "0.14.1", "published": "2026-01-28", "modified": "2026-09-10", "withdrawn": "", "url": "https://github.com/advisories/GHSA-qh4c-xf7m-gxfc", "foundAt": "2026-09-24 22:37:49" } ] } } } }, "404": { "description": "Not found" } } } }, "/api/packages": { "get": { "operationId": "list_packages", "summary": "Every project covered, most advisories first", "description": "Every project covered, most advisories first. Returns packages with id, name, category, the ecosystem packages, advisory counts, latest date, GitHub repo and company.", "parameters": [ { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "packages with id, name, category, the ecosystem packages, advisory counts, latest date, GitHub repo and company", "content": { "application/json": { "schema": { "type": "object" }, "example": { "packages": [ { "id": "tensorflow", "name": "TensorFlow", "category": "ML frameworks", "packages": [ { "ecosystem": "PyPI", "name": "tensorflow", "registry": "https://pypi.org/project/tensorflow/" } ], "advisories": 433, "criticalOrHighLast12Months": 0, "latest": "2024-07-30", "repo": "https://github.com/tensorflow/tensorflow", "reposPage": "https://repos.fru.dev/projects/tensorflow", "company": { "slug": "google", "profile": "https://companies.fru.dev/companies/google" }, "page": "https://advisories.fru.dev/packages/tensorflow" }, { "id": "open-webui", "name": "Open WebUI", "category": "Agents and LLM apps", "packages": [ { "ecosystem": "PyPI", "name": "open-webui", "registry": "https://pypi.org/project/open-webui/" } ], "advisories": 161, "criticalOrHighLast12Months": 65, "latest": "2026-09-10", "repo": "https://github.com/open-webui/open-webui", "reposPage": null, "company": null, "page": "https://advisories.fru.dev/packages/open-webui" } ], "total": 70, "limit": 2, "offset": 0, "next": "/api/packages?limit=2&offset=2" } } } } } } }, "/api/companies": { "get": { "operationId": "list_companies", "summary": "Companies behind the projects; with since, the registry feed of companies with new advisories", "description": "Companies behind the projects; with since, the registry feed of companies with new advisories. Returns companies with slug (companies.fru.dev), name, domain, projects and advisory count; with since: slug, name, domain, url, projects, advisories, updated_at and items (date, type, severity, score, title, id, cve, url, source_url).", "parameters": [ { "name": "since", "in": "query", "required": false, "description": "ISO date (YYYY-MM-DD) or datetime: only companies with advisories published or found since then, each with those advisories", "schema": { "type": "string" }, "example": "2026-09-01" }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "companies with slug (companies.fru.dev), name, domain, projects and advisory count; with since: slug, name, domain, url, projects, advisories, updated_at and items (date, type, severity, score, title, id, cve, url, source_url)", "content": { "application/json": { "schema": { "type": "object" }, "example": { "companies": [ { "id": "google", "slug": "google", "name": "Google", "domain": "google.com", "projects": [ "tensorflow", "keras" ], "advisories": 453, "latest": "2026-08-10", "page": "https://advisories.fru.dev/companies/google", "profile": "https://companies.fru.dev/companies/google" }, { "id": "n8n", "slug": "n8n", "name": "n8n", "domain": "n8n.io", "projects": [ "n8n" ], "advisories": 156, "latest": "2026-09-10", "page": "https://advisories.fru.dev/companies/n8n", "profile": "https://companies.fru.dev/companies/n8n" } ], "total": 29, "limit": 2, "offset": 0, "next": "/api/companies?limit=2&offset=2" } } } } } } }, "/api/changes": { "get": { "operationId": "list_changes", "summary": "Changes to advisories after they were first listed: severity, score, summary, fixed versions, withdrawals", "description": "Changes to advisories after they were first listed: severity, score, summary, fixed versions, withdrawals. Returns changes with advisory id, field, old and new value, time and source URL, newest first.", "parameters": [ { "name": "since", "in": "query", "required": false, "description": "ISO date (YYYY-MM-DD) or datetime", "schema": { "type": "string" }, "example": "2026-09-01" }, { "name": "limit", "in": "query", "required": false, "description": "Items, 1 to 500", "schema": { "type": "integer", "minimum": 1, "maximum": 500, "default": 200 } } ], "responses": { "200": { "description": "changes with advisory id, field, old and new value, time and source URL, newest first", "content": { "application/json": { "schema": { "type": "object" }, "example": { "changes": [ { "id": 3, "advisory": "PYSEC-2025-197", "field": "severity", "old": "unknown", "new": "low", "at": "2026-09-24 22:38:04", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3136", "summary": "A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory....", "product": "pytorch", "page": "https://advisories.fru.dev/advisories/PYSEC-2025-197" }, { "id": 2, "advisory": "PYSEC-2026-2179", "field": "severity", "old": "unknown", "new": "high", "at": "2026-09-24 22:37:57", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49119", "summary": "Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticat...", "product": "gradio", "page": "https://advisories.fru.dev/advisories/PYSEC-2026-2179" } ], "since": null } } } } } } }, "/api/search": { "get": { "operationId": "search", "summary": "Search packages, advisories, CVE ids and pages", "description": "Search packages, advisories, CVE ids and pages. Returns up to 20 ranked results with title, link and one line.", "parameters": [ { "name": "q", "in": "query", "required": true, "description": "Package, CVE or words", "schema": { "type": "string" }, "example": "langchain" }, { "name": "limit", "in": "query", "required": false, "description": "Results, 1 to 20", "schema": { "type": "integer", "minimum": 1, "maximum": 20, "default": 20 } } ], "responses": { "200": { "description": "up to 20 ranked results with title, link and one line", "content": { "application/json": { "schema": { "type": "object" }, "example": { "q": "langchain", "results": [ { "id": "pk:langchain", "group": "companies", "title": "LangChain", "subtitle": "45 advisories · Agents and LLM apps", "href": "/packages/langchain", "keywords": [ "langchain", "langchain" ], "logo": "https://img.logo.dev/langchain.com?token=...&retina=true&format=png&theme=light&size=64&fallback=404", "score": 1050 }, { "id": "co:langchain", "group": "pages", "title": "LangChain", "subtitle": "Company · 2 projects", "href": "/companies/langchain", "keywords": [ "langchain.com" ], "logo": "https://img.logo.dev/langchain.com?token=...&retina=true&format=png&theme=light&size=64&fallback=404", "score": 1000 } ] } } } } } } } } }