Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/323761?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/323761?format=api", "purl": "pkg:apk/alpine/qemu@6.1.1-r0?arch=x86_64&distroversion=v3.15&reponame=community", "type": "apk", "namespace": "alpine", "name": "qemu", "version": "6.1.1-r0", "qualifiers": { "arch": "x86_64", "distroversion": "v3.15", "reponame": "community" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/105935?format=api", "vulnerability_id": "VCID-8une-prt3-f3er", "summary": "mig-controller: incorrect namespaces handling may lead to not authorized usage of Migration Toolkit for Containers (MTC)", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3948.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3948.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3948", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32187", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00131", "scoring_system": "epss", "scoring_elements": "0.32259", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3948" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2022017", "reference_id": "2022017", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2022017" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:4848", "reference_id": "RHSA-2021:4848", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:4848" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0202", "reference_id": "RHSA-2022:0202", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0202" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/323761?format=api", "purl": "pkg:apk/alpine/qemu@6.1.1-r0?arch=x86_64&distroversion=v3.15&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/qemu@6.1.1-r0%3Farch=x86_64&distroversion=v3.15&reponame=community" } ], "aliases": [ "CVE-2021-3948" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8une-prt3-f3er" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99484?format=api", "vulnerability_id": "VCID-bhzq-vjuk-zuh2", "summary": "An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3713.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3713.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3713", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00103", "scoring_system": "epss", "scoring_elements": "0.27807", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00103", "scoring_system": "epss", "scoring_elements": "0.27874", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3544", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3544" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3545", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3545" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3546", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3546" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3638", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3638" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3682", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3682" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3713", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3713" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3748", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3748" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994640", "reference_id": "1994640", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1994640" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992727", "reference_id": "992727", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992727" }, { "reference_url": "https://security.gentoo.org/glsa/202208-27", "reference_id": "GLSA-202208-27", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-27" }, { "reference_url": "https://usn.ubuntu.com/5307-1/", "reference_id": "USN-5307-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5307-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/323761?format=api", "purl": "pkg:apk/alpine/qemu@6.1.1-r0?arch=x86_64&distroversion=v3.15&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/qemu@6.1.1-r0%3Farch=x86_64&distroversion=v3.15&reponame=community" } ], "aliases": [ "CVE-2021-3713" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bhzq-vjuk-zuh2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99492?format=api", "vulnerability_id": "VCID-yc5u-runz-h7en", "summary": "An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3930.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3930.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3930", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17233", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17311", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3930" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3930", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3930" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020588", "reference_id": "2020588", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020588" }, { "reference_url": "https://security.gentoo.org/glsa/202208-27", "reference_id": "GLSA-202208-27", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/202208-27" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:5065", "reference_id": "RHSA-2021:5065", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:5065" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2021:5238", "reference_id": "RHSA-2021:5238", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2021:5238" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2022:0081", "reference_id": "RHSA-2022:0081", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2022:0081" }, { "reference_url": "https://usn.ubuntu.com/5307-1/", "reference_id": "USN-5307-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5307-1/" }, { "reference_url": "https://usn.ubuntu.com/5772-1/", "reference_id": "USN-5772-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/5772-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/323761?format=api", "purl": "pkg:apk/alpine/qemu@6.1.1-r0?arch=x86_64&distroversion=v3.15&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/qemu@6.1.1-r0%3Farch=x86_64&distroversion=v3.15&reponame=community" } ], "aliases": [ "CVE-2021-3930" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yc5u-runz-h7en" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/qemu@6.1.1-r0%3Farch=x86_64&distroversion=v3.15&reponame=community" }