CVEs for a vendor

Page through the CVEs affecting a vendor.

GET/api/v1/vendors/{vendorSlug}/cves

CVE summary records affecting one vendor across all of its products, filterable by severity, KEV status, and more. Records share the same summary shape as the CVE list.

Parameters

Name	In	Type	Description
`vendorSlug`	path	string	Lowercase vendor key, e.g. meta.
`severity`	query	csv	Severity bands to include.
`kev`	query	boolean	Restrict to KEV-listed CVEs.
`has_exploit`	query	boolean	Filter on public exploit availability.
`sort`	query	string	Sort key: published, updated, cvss, or epss (prefix - for descending). Default: `-published`.
`limit`	query	integer	Page size, 1–100. Default: `25`.
`cursor`	query	string	Opaque cursor from the previous page.

Example request

curl "https://radicalnotion.ai/api/v1/vendors/meta/cves?limit=2" \
  -H "Authorization: Bearer $RN_TOKEN"

Example response

{
  "vendor": {
    "slug": "meta",
    "display": "Meta"
  },
  "data": [
    {
      "cve_id": "CVE-2026-44907",
      "state": "PUBLISHED",
      "title": null,
      "description": "A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).",
      "severity": "high",
      "cvss_score": 7.5,
      "cvss_score_source": "Meta",
      "date_published": "2026-07-21T16:03:32Z",
      "date_updated": "2026-07-21T17:22:34Z",
      "assigner": "Meta",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": "yes",
        "technical_impact": "partial",
        "decision": "track"
      },
      "epss": {
        "score": 0.00329,
        "percentile": 0.25273,
        "date": "2026-07-22"
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": null
    },
    {
      "cve_id": "CVE-2026-23870",
      "state": "PUBLISHED",
      "title": null,
      "description": "A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).",
      "severity": "high",
      "cvss_score": 7.5,
      "cvss_score_source": "Meta",
      "date_published": "2026-05-06T16:24:55Z",
      "date_updated": "2026-05-06T19:06:00Z",
      "assigner": "Meta",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": "yes",
        "technical_impact": "partial",
        "decision": "track"
      },
      "epss": {
        "score": 0.01533,
        "percentile": 0.72155,
        "date": "2026-07-22"
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": true,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": null
    }
  ],
  "pagination": {
    "limit": 2,
    "next_cursor": "eyJ2IjoiMjAyNi0wNS0wNlQxNjoyNDo1NVoiLCJpZCI6IkNWRS0yMDI2LTIzODcwIn0"
  }
}

Response schema

Field	Type	Description
`vendor.slug / vendor.display`	string	The resolved vendor.
`data[]`	object[]	CVE summary records (same shape as the CVE list).
`pagination.next_cursor`	string \| null	Pass as ?cursor= for the next page.

Responses

Status	Meaning
`200`	Success.
`400`	A path or query parameter failed validation.
`401`	Missing or invalid access token.
`429`	Rate limit exceeded.

Parameters

Name	In	Type	Description
`vendorSlug`	path	string	Lowercase vendor key, e.g. meta.
`severity`	query	csv	Severity bands to include.
`kev`	query	boolean	Restrict to KEV-listed CVEs.
`has_exploit`	query	boolean	Filter on public exploit availability.
`sort`	query	string	Sort key: published, updated, cvss, or epss (prefix - for descending). Default: `-published`.
`limit`	query	integer	Page size, 1–100. Default: `25`.
`cursor`	query	string	Opaque cursor from the previous page.

Example response

{
  "vendor": {
    "slug": "meta",
    "display": "Meta"
  },
  "data": [
    {
      "cve_id": "CVE-2026-44907",
      "state": "PUBLISHED",
      "title": null,
      "description": "A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).",
      "severity": "high",
      "cvss_score": 7.5,
      "cvss_score_source": "Meta",
      "date_published": "2026-07-21T16:03:32Z",
      "date_updated": "2026-07-21T17:22:34Z",
      "assigner": "Meta",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": "yes",
        "technical_impact": "partial",
        "decision": "track"
      },
      "epss": {
        "score": 0.00329,
        "percentile": 0.25273,
        "date": "2026-07-22"
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": false,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": null
    },
    {
      "cve_id": "CVE-2026-23870",
      "state": "PUBLISHED",
      "title": null,
      "description": "A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).",
      "severity": "high",
      "cvss_score": 7.5,
      "cvss_score_source": "Meta",
      "date_published": "2026-05-06T16:24:55Z",
      "date_updated": "2026-05-06T19:06:00Z",
      "assigner": "Meta",
      "kev": {
        "listed": false,
        "date_added": null
      },
      "ssvc": {
        "exploitation": null,
        "automatable": "yes",
        "technical_impact": "partial",
        "decision": "track"
      },
      "epss": {
        "score": 0.01533,
        "percentile": 0.72155,
        "date": "2026-07-22"
      },
      "has_patch": true,
      "has_workaround": false,
      "has_exploit": true,
      "has_detection": false,
      "detection_layers": [],
      "primary_cwe_id": null
    }
  ],
  "pagination": {
    "limit": 2,
    "next_cursor": "eyJ2IjoiMjAyNi0wNS0wNlQxNjoyNDo1NVoiLCJpZCI6IkNWRS0yMDI2LTIzODcwIn0"
  }
}

Field

Type

Description

vendor.slug / vendor.display

string

The resolved vendor.

data[]

object[]

CVE summary records (same shape as the CVE list).

pagination.next_cursor

string | null

Pass as ?cursor= for the next page.

Status

Meaning

200

Success.

400

A path or query parameter failed validation.

401

Missing or invalid access token.

429

Rate limit exceeded.