Technology Vulnerabilities

This endpoint returns package-level CVE and GHSA findings across every Bill of Materials in your tenant, so you can integrate Cranium's findings with vulnerability management tools like ServiceNow VR or Avalar.

List Technology Vulnerabilities

Returns a paginated list of technology vulnerabilities: package-level CVE and GHSA findings across all Bills of Materials in your tenant. This endpoint covers technology vulnerabilities only. For model vulnerability findings (attack categories from Cranium Arena), see the Arena Model Vulnerabilities endpoint reference.

Request

GET /api/public/vulnerabilities

Authentication

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_Vulnerabilities_Read

Query Parameters

Parameter	Type	Value
`limit`	integer	Results per page. Maximum 200.
`cursor`	string	Sync cursor. Omit on the first call to begin from the beginning. Pass `nextCursor` from the previous response on subsequent calls.
`updatedAfter`	ISO 8601 timestamp	Return only records updated at or after this timestamp. Use to recover a lost cursor or reset to a known point in time.

Response Fields

Field	Type	Rules
`uniqueId`	string	Stable composite identifier. Use as an opaque deduplication and correlation key in downstream systems.
`knownVulnerabilityId`	GUID	Identifier for the underlying vulnerability record.
`billOfMaterialsId`	GUID	Correlates with the Bill of Materials endpoint.
`billOfMaterialsName`	string	BOM name, denormalized for convenience.
`aiSystemIds`	array of GUID	AI Systems the parent BOM belongs to. Empty when the BOM has not been assigned to an AI System.
`packageName`	string	Name of the affected package.
`packageVersion`	string	Version of the affected package.
`issueId`	string	Identifier as reported by the upstream source (OSV). May be a `CVE-`, `GHSA-`, or `PYSEC-` identifier depending on which advisory database surfaced the finding.
`cveId`	string or null	CVE identifier when one is available. Equals `issueId` for CVE-sourced records; for GHSA- or PYSEC-sourced records, populated with the CVE alias when OSC captured one. Null when there is no associated CVE. Use this field, not `issueId`, when correlating with systems that key on CVE identifiers.
`summary`	string	Short description of the vulnerability.
`source`	string	Upstream advisory database, e.g. `OSV`.
`sourceUrl`	string	Link to upstream advisory.
`cvssSeverity`	string	One of `Critical`, `High`, `Medium`, `Low`, `None`.
`cvssScore`	decimal	CVSS score.
`fixedVersion`	string	Version in which the vulnerability was fixed, when known.
`discoveryDate`	ISO 8601 timestamp	When the vulnerability was discovered.
`resolvedDate`	ISO 8601 timestamp	When the vulnerability was resolved, when it has been.
`resolvedStatus`	integer	`Resolved`, `Ignored`, or `null` if not yet acted on.
`updatedDate`	ISO 8501 timestamp	Advances when new penetration test results arrive or when the finding is resolved or unresolved. This is the field the sync cursor tracks.

Sample Response

{
  "data": [
    {
      "uniqueId": "b7c8d9e0-1a2b-3c4d-5e6f-7a8b9c0d1e2f",
      "knownVulnerabilityId": "c8d9e0f1-2b3c-4d5e-6f7a-8b9c0d1e2f3a",
      "billOfMaterialsId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
      "billOfMaterialsName": "my-ml-service",
      "aiSystemIds": ["a2d78b6f-9c4c-4a7d-d16f-4e1d8c9b0f20"],
      "packageName": "numpy",
      "packageVersion": "1.21.0",
      "issueId": "GHSA-abcd-1234-efgh",
      "cveId": "CVE-2024-1234",
      "summary": "Buffer overflow in numpy array handling",
      "source": "OSV",
      "sourceUrl": "https://osv.dev/vulnerability/GHSA-abcd-1234-efgh",
      "cvssSeverity": "Critical",
      "cvssScore": 9.8,
      "fixedVersion": "1.24.0",
      "discoveryDate": "2026-01-10T08:00:00Z",
      "resolvedDate": null,
      "resolvedStatus": null,
      "updatedAt": "2026-04-01T00:00:00Z"
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA0LTAxVDAwOjAwOjAwWiIsImlkIjoiYjdjOGQ5ZTAifQ==",
    "hasMore": false
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-08-24T10:05:00Z"
  }
}

uniqueId is a stable composite key; treat it as opaque and us it for deduplication rather than parsing it. issueId is the identifier as originally reported by OSV and may be a CVE, GHSA, or PYSEC identifier; cveId is always CVE-format when populated, so use cveId rather than issueId when correlating with CVE-keyed systems like ServiceNow VR. resolvedStatus reflects user-actioned resolution only, and only for vulnerabilities still present in the current Bill of Materials. Unlike the UI and CSV export, this endpoint returns resolved and ignored vulnerabilities too, so filter on resolvedStatus: null if you want parity with what's shown on the platform.

When a package is updated or removed, its vulnerabilities are dropped from the feed entirely rather than marked resolved. This drop does not advance updatedAt, so incremental cursor-based polling will not catch it. To detect closed vulnerabilities, run a periodic full sync without a cursor and treat anything missing from that sync as closed.

Error Responses

400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
401 UNAUTHORIZED: the request is missing a token, or the token lacks Api_Vulnerabilities_Read.
500 INTERNAL_ERROR: an unexpected server error.

Did this answer your question?