Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/411512?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/411512?format=api", "purl": "pkg:apk/alpine/radare2@5.6.6-r0?arch=x86_64&distroversion=v3.19&reponame=community", "type": "apk", "namespace": "alpine", "name": "radare2", "version": "5.6.6-r0", "qualifiers": { "arch": "x86_64", "distroversion": "v3.19", "reponame": "community" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "5.6.8-r0", "latest_non_vulnerable_version": "5.8.2-r0", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99768?format=api", "vulnerability_id": "VCID-3u1s-fwgu-tubt", "summary": "Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-0849", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50262", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50234", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50254", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50193", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50243", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50215", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-0849" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478", "reference_id": "1014478", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/411512?format=api", "purl": "pkg:apk/alpine/radare2@5.6.6-r0?arch=x86_64&distroversion=v3.19&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@5.6.6-r0%3Farch=x86_64&distroversion=v3.19&reponame=community" } ], "aliases": [ "CVE-2022-0849" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3u1s-fwgu-tubt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99769?format=api", "vulnerability_id": "VCID-7aep-ks5e-tbc9", "summary": "Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1031", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50905", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50967", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50972", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50951", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50921", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00273", "scoring_system": "epss", "scoring_elements": "0.50938", "published_at": "2026-06-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1031" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478", "reference_id": "1014478", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/411512?format=api", "purl": "pkg:apk/alpine/radare2@5.6.6-r0?arch=x86_64&distroversion=v3.19&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@5.6.6-r0%3Farch=x86_64&distroversion=v3.19&reponame=community" } ], "aliases": [ "CVE-2022-1031" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7aep-ks5e-tbc9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99770?format=api", "vulnerability_id": "VCID-8cte-5c2k-73hs", "summary": "Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1052", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.35261", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.35366", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.35376", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.35341", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.353", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.0015", "scoring_system": "epss", "scoring_elements": "0.35319", "published_at": "2026-06-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1052" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478", "reference_id": "1014478", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/411512?format=api", "purl": "pkg:apk/alpine/radare2@5.6.6-r0?arch=x86_64&distroversion=v3.19&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@5.6.6-r0%3Farch=x86_64&distroversion=v3.19&reponame=community" } ], "aliases": [ "CVE-2022-1052" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-8cte-5c2k-73hs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/99775?format=api", "vulnerability_id": "VCID-c4cf-mduy-aufy", "summary": "Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1240", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0017", "scoring_system": "epss", "scoring_elements": "0.37965", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.0017", "scoring_system": "epss", "scoring_elements": "0.37977", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.0024", "scoring_system": "epss", "scoring_elements": "0.47197", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.0024", "scoring_system": "epss", "scoring_elements": "0.47263", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.0024", "scoring_system": "epss", "scoring_elements": "0.47265", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.0024", "scoring_system": "epss", "scoring_elements": "0.47247", "published_at": "2026-06-07T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-1240" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478", "reference_id": "1014478", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014478" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/411512?format=api", "purl": "pkg:apk/alpine/radare2@5.6.6-r0?arch=x86_64&distroversion=v3.19&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@5.6.6-r0%3Farch=x86_64&distroversion=v3.19&reponame=community" } ], "aliases": [ "CVE-2022-1240" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c4cf-mduy-aufy" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@5.6.6-r0%3Farch=x86_64&distroversion=v3.19&reponame=community" }