List vulnerabilities | Modular DS

{
  "data": [
    {
      "attributes": {
        "affected_version_range": "<= 8.9.3",
        "component": {
          "id": 42,
          "name": "WooCommerce",
          "slug": "woocommerce",
          "type": "plugin"
        },
        "description": "The WooCommerce plugin is vulnerable to reflected cross-site scripting via the wc_ajax parameter in versions up to and including 8.9.3 due to insufficient input sanitization and output escaping.",
        "discovered_at": "2026-09-01T08:00:00.000000Z",
        "name": "WooCommerce < 8.10 - Reflected Cross-Site Scripting",
        "score": 6.1,
        "severity": "h",
        "site": {
          "id": 12,
          "name": "Acme Shop"
        },
        "source_name": "WPScan",
        "source_url": "https://wpscan.com/vulnerability/abcd1234",
        "unfixed": false
      },
      "id": "551-12",
      "type": "site-vulnerabilities"
    },
    {
      "attributes": {
        "affected_version_range": null,
        "component": {
          "id": 58,
          "name": "Contact Form Builder",
          "slug": "contact-form-builder",
          "type": "plugin"
        },
        "description": "A vulnerability was reported for this component but has not yet been fully triaged by the source feed.",
        "discovered_at": "2026-09-18T07:30:00.000000Z",
        "name": "Unspecified plugin - Remote Code Execution",
        "score": null,
        "severity": "null",
        "site": {
          "id": 12,
          "name": "Acme Shop"
        },
        "source_name": "Patchstack",
        "source_url": "https://patchstack.com/database/vulnerability/efgh5678",
        "unfixed": true
      },
      "id": "612-12",
      "type": "site-vulnerabilities"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "links": {
    "first": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1",
    "last": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1",
    "next": null,
    "prev": null
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "active": false,
        "label": "&laquo; Previous",
        "url": null
      },
      {
        "active": true,
        "label": "1",
        "url": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1"
      },
      {
        "active": false,
        "label": "Next &raquo;",
        "url": null
      }
    ],
    "path": "{{base_url}}/api/public/v1/vulnerabilities",
    "per_page": 15,
    "to": 2,
    "total": 2
  }
}

JSON:API collection (type site-vulnerabilities) of the organization’s known vulnerabilities, one entry per (site, vulnerability) pair - the same vulnerability legitimately appears once per affected site, so ids are composite ("{vulnerability_id}-{site_id}"). Each entry carries name, description, severity, score, affected_version_range, unfixed (no fix available yet), discovered_at, source_name, source_url, and inlines the affected site (id, name) and component (id, name, type, slug).

Severity uses the raw stored codes: c critical, h high, m medium, l low, n none/informational, and the literal string null for unknown. Default sort puts the most severe first.

No detail route exists for this resource, so entries carry no links. Only sites you have access to appear; the data is refreshed by the vulnerability scan pipeline. The MCP twin of this endpoint is the vulnerabilities-index tool.

JSON:API collection (type `site-vulnerabilities`) of the organization's known vulnerabilities, one entry per **(site, vulnerability) pair** - the same vulnerability legitimately appears once per affected site, so ids are composite (`"{vulnerability_id}-{site_id}"`). Each entry carries `name`, `description`, `severity`, `score`, `affected_version_range`, `unfixed` (no fix available yet), `discovered_at`, `source_name`, `source_url`, and inlines the affected `site` (`id`, `name`) and `component` (`id`, `name`, `type`, `slug`). Severity uses the raw stored codes: `c` critical, `h` high, `m` medium, `l` low, `n` none/informational, and the literal string `null` for unknown. Default sort puts the most severe first. No detail route exists for this resource, so entries carry no `links`. Only sites you have access to appear; the data is refreshed by the vulnerability scan pipeline. The MCP twin of this endpoint is the `vulnerabilities-index` tool.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Query parameters

filter[site][]stringOptional

Limit to one or several sites (integer ids, repeatable)

filter[severity][]stringOptional

c=critical, h=high, m=medium, l=low, n=none/info, null=unknown

filter[component_type]stringOptional

sortstringOptional

severity (default, most severe first), discovered_at, name; prefix with - to invert

page[number]stringOptional

page[size]stringOptional

Max 50

Response

200 - Vulnerabilities affecting the organization’s websites

datalist of objectsOptional

jsonapiobjectOptional

linksobjectOptional

metaobjectOptional

Severity uses the raw stored codes: c critical, h high, m medium, l low, n none/informational, and the literal string null for unknown. Default sort puts the most severe first.