List vulnerabilities | Modular DS

JSON:API collection (type site-vulnerabilities) of the organization’s known vulnerabilities, one entry per (site, vulnerability) pair — the same vulnerability legitimately appears once per affected site, so ids are composite ("{vulnerability_id}-{site_id}"). Each entry inlines the affected site (id, name) and component (id, name, type, slug) plus severity, score, affected_version_range, unfixed (no fix available yet) and discovered_at.

Severity uses the raw stored codes: c critical, h high, m medium, l low, n none/informational, and the literal string null for unknown. Default sort puts the most severe first.

Only sites you have access to appear; the data is refreshed by the vulnerability scan pipeline. The MCP twin of this endpoint is the vulnerabilities-index tool.

JSON:API collection (type `site-vulnerabilities`) of the organization's known vulnerabilities, one entry per **(site, vulnerability) pair** — the same vulnerability legitimately appears once per affected site, so ids are composite (`"{vulnerability_id}-{site_id}"`). Each entry inlines the affected `site` (`id`, `name`) and `component` (`id`, `name`, `type`, `slug`) plus `severity`, `score`, `affected_version_range`, `unfixed` (no fix available yet) and `discovered_at`. Severity uses the raw stored codes: `c` critical, `h` high, `m` medium, `l` low, `n` none/informational, and the literal string `null` for unknown. Default sort puts the most severe first. Only sites you have access to appear; the data is refreshed by the vulnerability scan pipeline. The MCP twin of this endpoint is the `vulnerabilities-index` tool.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Response

Successful response

Severity uses the raw stored codes: c critical, h high, m medium, l low, n none/informational, and the literal string null for unknown. Default sort puts the most severe first.

Only sites you have access to appear; the data is refreshed by the vulnerability scan pipeline. The MCP twin of this endpoint is the vulnerabilities-index tool.