Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/1035793?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/1035793?format=api", "purl": "pkg:deb/debian/flex@2.5.4a-6", "type": "deb", "namespace": "debian", "name": "flex", "version": "2.5.4a-6", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.6.1-1.3", "latest_non_vulnerable_version": "2.6.1-1.3", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/58500?format=api", "vulnerability_id": "VCID-513p-wenf-vkfn", "summary": "Flex might generate code with a buffer overflow making applications\n using such scanners vulnerable to the execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6354.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-6354.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6354", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.9748", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97487", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97491", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97498", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97499", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97502", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97505", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.43342", "scoring_system": "epss", "scoring_elements": "0.97513", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6354" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "1.9", "scoring_system": "cvssv2", "scoring_elements": "AV:L/AC:M/Au:N/C:N/I:N/A:P" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1360743", "reference_id": "1360743", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1360743" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832768", "reference_id": "832768", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832768" }, { "reference_url": "https://security.gentoo.org/glsa/201701-31", "reference_id": "GLSA-201701-31", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201701-31" }, { "reference_url": "https://security.gentoo.org/glsa/201802-03", "reference_id": "GLSA-201802-03", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201802-03" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1035801?format=api", "purl": "pkg:deb/debian/flex@2.5.39-8%2Bdeb8u2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-513p-wenf-vkfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/flex@2.5.39-8%252Bdeb8u2" }, { "url": "http://public2.vulnerablecode.io/api/packages/1058037?format=api", "purl": "pkg:deb/debian/flex@2.6.1-1.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/flex@2.6.1-1.3" } ], "aliases": [ "CVE-2016-6354" ], "risk_score": 2.6, "exploitability": "0.5", "weighted_severity": "5.3", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-513p-wenf-vkfn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/87908?format=api", "vulnerability_id": "VCID-a1vt-7bhu-mqgv", "summary": "flex: Security fixes in v2.5.35", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0634.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2010-0634.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2010-0634", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55261", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.5536", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55384", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55362", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55413", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55423", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55401", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55383", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00323", "scoring_system": "epss", "scoring_elements": "0.55419", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-0634" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0634", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0634" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=564560", "reference_id": "564560", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=564560" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1035797?format=api", "purl": "pkg:deb/debian/flex@2.5.35-6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-513p-wenf-vkfn" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/flex@2.5.35-6" } ], "aliases": [ "CVE-2010-0634" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a1vt-7bhu-mqgv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/31674?format=api", "vulnerability_id": "VCID-pggd-3e85-u7c3", "summary": "flex might generate code with a buffer overflow, making applications using\n such scanners vulnerable to the execution of arbitrary code.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-0459.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-0459.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2006-0459", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88327", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88335", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.8835", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88354", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88374", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.8838", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.8839", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88382", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0397", "scoring_system": "epss", "scoring_elements": "0.88397", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2006-0459" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0459", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0459" }, { "reference_url": "https://security.gentoo.org/glsa/200603-07", "reference_id": "GLSA-200603-07", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/200603-07" }, { "reference_url": "https://usn.ubuntu.com/260-1/", "reference_id": "USN-260-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/260-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1035796?format=api", "purl": "pkg:deb/debian/flex@2.5.33-11", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-513p-wenf-vkfn" }, { "vulnerability": "VCID-a1vt-7bhu-mqgv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/flex@2.5.33-11" } ], "aliases": [ "CVE-2006-0459" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-pggd-3e85-u7c3" } ], "fixing_vulnerabilities": [], "risk_score": "2.6", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/flex@2.5.4a-6" }