Affected products
Affected products and packages from every source.
GET/api/v1/cves/{cveId}/affected
Affected vendor / product / package entries from every source that asserted them — the CNA record, CISA ADP, GitHub Security Advisories, OSV, NVD CPE data, and Radical Notion analysis — with version ranges, patched versions, ecosystems, platforms, and CPEs preserved per source.
Sources genuinely disagree about affected ranges; the API returns each source’s claim verbatim rather than collapsing them, so you can apply your own trust policy.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
cveId | path | string | CVE identifier. |
source | query | string | Only entries from one source: cna, adp, ghsa, osv, nvd, rn_analysis. |
ecosystem | query | string | Only entries in one package ecosystem (npm, PyPI, Maven, ...). |
Example request
curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182/affected?source=ghsa&ecosystem=npm" \
-H "Authorization: Bearer $RN_TOKEN"Example response(trimmed to two entries for brevity)
{
"cve_id": "CVE-2025-55182",
"count": 9,
"entries": [
{
"source": "ghsa",
"vendor": null,
"product": "react-server-dom-parcel",
"package_name": "react-server-dom-parcel",
"ecosystem": "npm",
"platforms": null,
"default_status": null,
"affected_versions": null,
"affected_ranges": [
{
"fixed": "19.1.2",
"introduced": "19.1.0",
"version_type": "ecosystem"
}
],
"patched_versions": [
"19.1.2"
],
"cpes": null,
"repo_url": "https://github.com/facebook/react",
"collection_url": null,
"package_url": "pkg:npm/react-server-dom-parcel",
"vulnerable_functions": null,
"advisory_severity": null,
"advisory_urgency": null,
"advisory_description": null,
"updated_at": "2026-07-18T20:43:54Z"
},
{
"source": "ghsa",
"vendor": null,
"product": "react-server-dom-parcel",
"package_name": "react-server-dom-parcel",
"ecosystem": "npm",
"platforms": null,
"default_status": null,
"affected_versions": null,
"affected_ranges": [
{
"fixed": "19.2.1",
"introduced": "19.2.0",
"version_type": "ecosystem",
"last_affected": "19.2.0"
}
],
"patched_versions": [
"19.2.1"
],
"cpes": null,
"repo_url": "https://github.com/facebook/react",
"collection_url": null,
"package_url": "pkg:npm/react-server-dom-parcel",
"vulnerable_functions": null,
"advisory_severity": null,
"advisory_urgency": null,
"advisory_description": null,
"updated_at": "2026-07-18T20:43:54Z"
}
]
}Response schema
| Field | Type | Description |
|---|---|---|
entries[].source | string | Which source asserted the entry. |
entries[].vendor / product | string | null | Vendor and product names as the source states them. |
entries[].package_name / ecosystem | string | null | Package coordinates for ecosystem sources (GHSA/OSV). |
entries[].affected_versions | string[] | null | Explicit affected version list, when enumerated. |
entries[].affected_ranges | object[] | null | Structured version ranges (introduced/fixed bounds). |
entries[].patched_versions | string[] | null | First patched versions per range. |
entries[].default_status | string | null | Status for versions not matched by any range. |
entries[].cpes | string[] | null | CPE URIs bound to the entry. |
entries[].platforms | string[] | null | Platform qualifiers, when stated. |
Responses
| Status | Meaning |
|---|---|
200 | Success. |
400 | A path or query parameter failed validation. |
401 | Missing or invalid access token. |
403 | The CVE is outside your access tier. |
404 | No record exists for the CVE. |
429 | Rate limit exceeded. |
A CVE with no affected entries from the requested source returns count 0.
{
"cve_id": "CVE-2025-55182",
"count": 0,
"entries": []
}