List vulnerabilities

GET

https://api.modulards.com/api/public/v1/vulnerabilities

GET

/api/public/v1/vulnerabilities

curl https://api.modulards.com/api/public/v1/vulnerabilities \
     -H "Authorization: Bearer <token>"

200200 - Vulnerabilities affecting the organization's websites

{
  "data": [
    {
      "attributes": {
        "affected_version_range": "<= 8.9.3",
        "component": {
          "id": 42,
          "name": "WooCommerce",
          "slug": "woocommerce",
          "type": "plugin"
        },
        "description": "The WooCommerce plugin is vulnerable to reflected cross-site scripting via the wc_ajax parameter in versions up to and including 8.9.3 due to insufficient input sanitization and output escaping.",
        "discovered_at": "2026-09-01T08:00:00.000000Z",
        "name": "WooCommerce < 8.10 - Reflected Cross-Site Scripting",
        "score": 6.1,
        "severity": "h",
        "site": {
          "id": 12,
          "name": "Acme Shop"
        },
        "source_name": "WPScan",
        "source_url": "https://wpscan.com/vulnerability/abcd1234",
        "unfixed": false
      },
      "id": "551-12",
      "type": "site-vulnerabilities"
    },
    {
      "attributes": {
        "affected_version_range": null,
        "component": {
          "id": 58,
          "name": "Contact Form Builder",
          "slug": "contact-form-builder",
          "type": "plugin"
        },
        "description": "A vulnerability was reported for this component but has not yet been fully triaged by the source feed.",
        "discovered_at": "2026-09-18T07:30:00.000000Z",
        "name": "Unspecified plugin - Remote Code Execution",
        "score": null,
        "severity": "null",
        "site": {
          "id": 12,
          "name": "Acme Shop"
        },
        "source_name": "Patchstack",
        "source_url": "https://patchstack.com/database/vulnerability/efgh5678",
        "unfixed": true
      },
      "id": "612-12",
      "type": "site-vulnerabilities"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "links": {
    "first": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1",
    "last": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1",
    "next": null,
    "prev": null
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "active": false,
        "label": "&laquo; Previous",
        "url": null
      },
      {
        "active": true,
        "label": "1",
        "url": "{{base_url}}/api/public/v1/vulnerabilities?page%5Bnumber%5D=1"
      },
      {
        "active": false,
        "label": "Next &raquo;",
        "url": null
      }
    ],
    "path": "{{base_url}}/api/public/v1/vulnerabilities",
    "per_page": 15,
    "to": 2,
    "total": 2
  }
}

Lists the known vulnerabilities that affect the websites your token can reach, with one entry for each website and vulnerability pair: a vulnerability that affects three websites appears three times. Use it to answer questions such as “which of my websites have a critical vulnerability?” or to build a security overview across websites.

Each entry names the affected website and component (WordPress, a plugin, a theme, PHP or the database engine), the severity, the affected version range and whether a fix exists yet.

Severity uses the codes c critical, h high, m medium, l low and n none or informational, and the value null when it is unknown. The most severe come first unless you sort otherwise.

Entries have no detail endpoint, so they carry no self link. Only websites your token can reach appear.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Query parameters

filter[site][]stringOptional

Only the vulnerabilities of these websites, by website id. Several ids match any of them.

filter[severity][]stringOptional

Only these severities: c critical, h high, m medium, l low, n none or informational, null unknown. Several values match any of them.

sortstringOptional

Sort order. Accepted: severity, discovered_at, name; a leading - reverses the order. Default -severity, the most severe first (plain severity lists the least severe first).

page[number]stringOptional

Page number, starting at 1.

page[size]stringOptional

Rows per page, up to 50 (default 15).

filter[component_type][]stringOptional

Only vulnerabilities in these kinds of component: core (WordPress), plugin, theme, php, mariadb or mysql. Several values match any of them.

Response

200 - Vulnerabilities affecting the organization's websites

datalist of objectsOptional

jsonapiobjectOptional

linksobjectOptional

metaobjectOptional