This endpoint returns package-level CVE and GHSA findings across every Bill of Materials in your tenant, so you can integrate Cranium's findings with vulnerability management tools like ServiceNow VR or Avalar.

List Technology Vulnerabilities

Returns a paginated list of technology vulnerabilities: package-level CVE and GHSA findings across all Bills of Materials in your tenant. This endpoint covers technology vulnerabilities only. For model vulnerability findings (attack categories from Cranium Arena), see the Arena Model Vulnerabilities endpoint reference.

Request

GET /api/public/vulnerabilities

Authentication

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_Vulnerabilities_Read

Query Parameters

Response Fields

Sample Response

{
  "data": [
    {
      "uniqueId": "b7e23c1a-4f9d-4b2e-8c1a-9f6e3d4c5a7b-4567abcd-1234-5678-9abc-def012345678",
      "knownVulnerabilityId": "4567abcd-1234-5678-9abc-def012345678",
      "billOfMaterialsId": "b7e23c1a-4f9d-4b2e-8c1a-9f6e3d4c5a7b",
      "billOfMaterialsName": "my-ml-service",
      "repositoryUrl": "https://github.com/contoso/my-ml-service",
      "aiSystemIds": ["a2d78b6f-9c4c-4a7d-d16f-4e1d8c9b0f20"],
      "packageName": "numpy",
      "packageVersion": "1.21.0",
      "issueId": "GHSA-fpfv-jqm9-f5jm",
      "cveId": "CVE-2024-1234",
      "summary": "Buffer overflow in numpy array handling when parsing untrusted input",
      "source": "OSV",
      "sourceUrl": "https://osv.dev/vulnerability/GHSA-fpfv-jqm9-f5jm",
      "cvssSeverity": "Critical",
      "cvssScore": 9.8,
      "fixedVersion": "1.24.0",
      "discoveryDate": "2026-01-10T08:00:00Z",
      "resolvedDate": null,
      "resolvedStatus": null,
      "updatedAt": "2026-01-10T08:00:00Z",
      "isAi": false
    },
    {
      "uniqueId": "b7e23c1a-4f9d-4b2e-8c1a-9f6e3d4c5a7b-5678bcde-2345-6789-abcd-ef0123456789",
      "knownVulnerabilityId": "5678bcde-2345-6789-abcd-ef0123456789",
      "billOfMaterialsId": "b7e23c1a-4f9d-4b2e-8c1a-9f6e3d4c5a7b",
      "billOfMaterialsName": "my-ml-service",
      "repositoryUrl": "https://github.com/contoso/my-ml-service",
      "aiSystemIds": ["a2d78b6f-9c4c-4a7d-d16f-4e1d8c9b0f20"],
      "packageName": "transformers",
      "packageVersion": "4.30.2",
      "issueId": "PYSEC-2025-0042",
      "cveId": null,
      "summary": "Insecure deserialization in transformers config loader allows arbitrary code execution",
      "source": "OSV",
      "sourceUrl": "https://osv.dev/vulnerability/PYSEC-2025-0042",
      "cvssSeverity": "High",
      "cvssScore": 8.1,
      "fixedVersion": "4.38.0",
      "discoveryDate": "2026-03-22T11:14:00Z",
      "resolvedDate": "2026-04-01T00:00:00Z",
      "resolvedStatus": "Resolved",
      "updatedAt": "2026-04-01T00:00:00Z",
      "isAi": true
    },
    {
      "uniqueId": "d9a45e3c-6f1f-4d4a-ae3c-1b8a5f6e7c9d-6789cdef-3456-789a-bcde-f01234567890",
      "knownVulnerabilityId": "6789cdef-3456-789a-bcde-f01234567890",
      "billOfMaterialsId": "d9a45e3c-6f1f-4d4a-ae3c-1b8a5f6e7c9d",
      "billOfMaterialsName": "customer-support-bot",
      "repositoryUrl": "https://bitbucket.org/contoso/support-bot",
      "aiSystemIds": [
        "a2d78b6f-9c4c-4a7d-d16f-4e1d8c9b0f20",
        "b3e89c7a-0d5d-4b8e-e27a-5f2e9d0a1f31"
      ],
      "packageName": "requests",
      "packageVersion": "2.28.1",
      "issueId": "CVE-2023-32681",
      "cveId": "CVE-2023-32681",
      "summary": "Proxy-Authorization header leaked to destination server in cross-origin redirects",
      "source": "OSV",
      "sourceUrl": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q",
      "cvssSeverity": "Medium",
      "cvssScore": 6.1,
      "fixedVersion": "2.31.0",
      "discoveryDate": "2025-11-05T09:00:00Z",
      "resolvedDate": "2026-05-20T18:30:00Z",
      "resolvedStatus": "Ignored",
      "updatedAt": "2026-05-20T18:30:00Z",
      "isAi": null
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA1LTIwVDE4OjMwOjAwWiIsImlkIjoiNjc4OWNkZWYifQ==",
    "hasMore": true
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-06-02T10:00:00Z"
  }
}

uniqueId is a stable composite key; treat it as opaque and use it for deduplication rather than parsing it. issueId is the identifier as originally reported by OSV and may be a CVE, GHSA, or PYSEC identifier; cveId is always CVE-format when populated, so use cveId rather than issueId when correlating with CVE-keyed systems like ServiceNow VR. resolvedStatus reflects user-actioned resolution only, and only for vulnerabilities still present in the current Bill of Materials. Unlike the UI and CSV export, this endpoint returns resolved and ignored vulnerabilities too, so filter on resolvedStatus: null if you want parity with what's shown on the platform.

When a package is updated or removed, its vulnerabilities are dropped from the feed entirely rather than marked resolved. This drop does not advance updatedAt, so incremental cursor-based polling will not catch it. To detect closed vulnerabilities, run a periodic full sync without a cursor and treat anything missing from that sync as closed.

isAi labels vulnerabilities on AI-based technologies. In the sample, it is false for numpy, true for transformers and null for requests. A change to isAi alone does not advance updatedAt, so cursor-based polling does not return it. Run one full sync without a cursor to load isAi on vulnerabilities that existed before the field was added. The periodic full sync described above also picks up later label changes. If your integration requires a fixed set of fields, update it to accept isAi and repositoryUrl.

Error Responses

• 400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
• 401 UNAUTHORIZED: the request is missing a token, or the token lacks Api_Vulnerabilities_Read.
• 500 INTERNAL_ERROR: an unexpected server error.

Every error response includes error.traceId. The same value is returned in the X-Request-Id response header. Include it when reporting an issue to Cranium support.