> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Get vulnerabilities

> Retrieves a comprehensive list of security vulnerabilities identified across targets and assets, including detailed information about risks and remediation recommendations.



## OpenAPI

````yaml /api-reference/openapi.json get /api/vulnerabilities
openapi: 3.0.0
info:
  title: Open Attack Surface Management
  description: Open-source platform for cybersecurity Attack Surface Management (ASM)
  version: '1.0'
  contact: {}
servers:
  - url: https://{baseUrl}/api/v1
    variables:
      baseUrl:
        default: localhost:3000
        description: API server hostname with port (e.g. localhost:3000, api.example.com)
security: []
tags: []
externalDocs:
  description: Authentication Docs
  url: auth/docs
paths:
  /api/vulnerabilities:
    get:
      tags:
        - Vulnerabilities
      summary: Get vulnerabilities
      description: >-
        Retrieves a comprehensive list of security vulnerabilities identified
        across targets and assets, including detailed information about risks
        and remediation recommendations.
      operationId: VulnerabilitiesController_getVulnerabilities
      parameters:
        - name: search
          required: false
          in: query
          schema:
            type: string
        - name: page
          required: false
          in: query
          schema:
            example: 1
            type: number
        - name: limit
          required: false
          in: query
          schema:
            example: 10
            type: number
        - name: sortBy
          required: false
          in: query
          schema:
            example: createdAt
            type: string
        - name: sortOrder
          required: false
          in: query
          schema:
            example: DESC
            type: string
        - name: targetIds
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: q
          required: false
          in: query
          schema:
            type: string
        - name: status
          required: false
          in: query
          description: 'Filter by vulnerability status: open, dismissed, or all'
          schema:
            default: open
            type: string
            enum:
              - open
              - dismissed
              - all
        - name: severity
          required: false
          in: query
          description: 'Filter by severity levels: info, low, medium, high, critical'
          schema:
            type: array
            items:
              type: string
              enum:
                - info
                - low
                - medium
                - high
                - critical
        - name: createdFrom
          required: false
          in: query
          description: Filter by creation date from (ISO 8601 format, e.g., 2026-01-01)
          schema:
            example: '2026-01-01'
            type: string
        - name: createdTo
          required: false
          in: query
          description: Filter by creation date to (ISO 8601 format, e.g., 2026-01-31)
          schema:
            example: '2026-01-31'
            type: string
        - name: tags
          required: false
          in: query
          description: Filter by vulnerability tags
          schema:
            type: array
            items:
              type: string
        - name: targetId
          required: false
          in: query
          description: Filter vulnerabilities by target ID
          schema:
            type: string
        - name: X-Workspace-Id
          in: header
          description: Workspace ID
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetManyVulnerabilityDto'
                allOf:
                  - $ref: '#/components/schemas/AppResponseSerialization'
components:
  schemas:
    GetManyVulnerabilityDto:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
        total:
          type: number
        page:
          type: number
        limit:
          type: number
        hasNextPage:
          type: boolean
        pageCount:
          type: number
      required:
        - data
        - total
        - page
        - limit
        - hasNextPage
        - pageCount
    Vulnerability:
      type: object
      properties:
        id:
          type: string
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        description:
          type: string
        synopsis:
          type: string
        severity:
          type: string
          enum:
            - info
            - low
            - medium
            - high
            - critical
        tags:
          type: array
          items:
            type: string
        references:
          type: array
          items:
            type: string
        authors:
          type: array
          items:
            type: string
        affectedUrl:
          type: string
        ipAddress:
          type: string
        host:
          type: string
        ports:
          type: array
          items:
            type: string
        cvssMetric:
          type: string
        cvssScore:
          type: number
        epssScore:
          type: number
        vprScore:
          type: number
        cveId:
          type: array
          items:
            type: string
        bidId:
          type: array
          items:
            type: string
        cweId:
          type: array
          items:
            type: string
        ceaId:
          type: array
          items:
            type: string
        iava:
          type: array
          items:
            type: string
        cveUrl:
          type: string
        cweUrl:
          type: string
        solution:
          type: string
        extractorName:
          type: string
        extractedResults:
          type: array
          items:
            type: string
        publicationDate:
          format: date-time
          type: string
        modificationDate:
          format: date-time
          type: string
        firstDetectedDate:
          format: date-time
          type: string
        lastSeenDate:
          format: date-time
          type: string
        tool:
          $ref: '#/components/schemas/Tool'
        asset:
          $ref: '#/components/schemas/Asset'
        vulnerabilityDismissal:
          $ref: '#/components/schemas/VulnerabilityDismissal'
        analyzeStatus:
          type: string
          enum:
            - not_analyzed
            - running
            - done
            - failed
        analyzeResult:
          type: string
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - description
        - synopsis
        - severity
        - tags
        - references
        - authors
        - affectedUrl
        - ipAddress
        - host
        - ports
        - cvssMetric
        - cvssScore
        - epssScore
        - vprScore
        - cveId
        - bidId
        - cweId
        - ceaId
        - iava
        - cveUrl
        - cweUrl
        - solution
        - extractorName
        - extractedResults
        - publicationDate
        - modificationDate
        - firstDetectedDate
        - lastSeenDate
        - tool
        - asset
        - vulnerabilityDismissal
        - analyzeStatus
        - analyzeResult
    Tool:
      type: object
      properties:
        id:
          type: string
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        description:
          type: string
        command:
          type: string
        category:
          type: string
          enum:
            - subdomains
            - http_probe
            - ports_scanner
            - vulnerabilities
            - screenshot
            - classifier
            - assistant
        version:
          type: string
        logoUrl:
          type: string
          nullable: true
        isBuiltIn:
          type: boolean
        isInstalled:
          type: boolean
        isOfficialSupport:
          type: boolean
        type:
          type: string
          enum:
            - built_in
            - provider
        providerId:
          type: string
        availableWorkersCount:
          type: number
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - description
        - command
        - category
        - version
        - isBuiltIn
        - isInstalled
        - isOfficialSupport
        - type
        - providerId
    Asset:
      type: object
      properties:
        id:
          type: string
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        value:
          type: string
        targetId:
          type: string
        isPrimary:
          type: boolean
        dnsRecords:
          type: object
        isEnabled:
          type: boolean
      required:
        - id
        - createdAt
        - updatedAt
        - value
        - targetId
        - isPrimary
        - dnsRecords
        - isEnabled
    VulnerabilityDismissal:
      type: object
      properties:
        id:
          type: string
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        vulnerabilityId:
          type: string
        userId:
          type: string
        reason:
          type: string
          enum:
            - false_positive
            - used_in_test
            - wont_fix
        comment:
          type: string
        user:
          $ref: '#/components/schemas/User'
        vulnerability:
          $ref: '#/components/schemas/Vulnerability'
      required:
        - id
        - createdAt
        - updatedAt
        - vulnerabilityId
        - userId
        - reason
        - comment
        - user
        - vulnerability
    User:
      type: object
      properties:
        id:
          type: string
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
        name:
          type: string
        role:
          type: string
          enum:
            - admin
            - user
            - bot
      required:
        - id
        - createdAt
        - updatedAt
        - name
        - role

````