Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/438237?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "type": "apk", "namespace": "alpine", "name": "radare2", "version": "3.9.0-r0", "qualifiers": { "arch": "aarch64", "distroversion": "v3.18", "reponame": "community" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "4.0.0-r0", "latest_non_vulnerable_version": "5.8.2-r0", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/194183?format=api", "vulnerability_id": "VCID-3px7-6e74-cqfe", "summary": "In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12865", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54437", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54482", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54458", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54474", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54443", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54495", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54489", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54501", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54484", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54463", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54502", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00313", "scoring_system": "epss", "scoring_elements": "0.54505", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00327", "scoring_system": "epss", "scoring_elements": "0.55654", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00327", "scoring_system": "epss", "scoring_elements": "0.55542", "published_at": "2026-04-01T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12865" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930704", "reference_id": "930704", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930704" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" } ], "aliases": [ "CVE-2019-12865" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3px7-6e74-cqfe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/194115?format=api", "vulnerability_id": "VCID-3wjf-z8kn-23g1", "summary": "In radare2 through 3.5.1, there is a heap-based buffer over-read in the r_egg_lang_parsechar function of egg_lang.c. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact because of missing length validation in libr/egg/egg.c.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12790", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65035", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65085", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65112", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65075", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65125", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65138", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65157", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65147", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.6512", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65156", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65166", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65149", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65165", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65179", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00481", "scoring_system": "epss", "scoring_elements": "0.65178", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12790" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930344", "reference_id": "930344", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930344" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" } ], "aliases": [ "CVE-2019-12790" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3wjf-z8kn-23g1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/194153?format=api", "vulnerability_id": "VCID-7gtx-pkzb-yqcz", "summary": "radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact, as demonstrated by newstr buffer overflows during replace operations. This affects libr/asm/asm.c and libr/parse/parse.c.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12829", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73702", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73712", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73735", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73707", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73742", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73755", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73778", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73759", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.7375", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73792", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73801", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73791", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73824", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73833", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00784", "scoring_system": "epss", "scoring_elements": "0.73834", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12829" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930590", "reference_id": "930590", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930590" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" } ], "aliases": [ "CVE-2019-12829" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7gtx-pkzb-yqcz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/194127?format=api", "vulnerability_id": "VCID-ba9q-e289-ekbt", "summary": "In radare2 through 3.5.1, the rcc_context function of libr/egg/egg_lang.c mishandles changing context. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact (invalid memory access in r_egg_lang_parsechar; invalid free in rcc_pusharg).", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12802", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.6404", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64097", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64124", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64083", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64134", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.6415", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64162", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64151", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64122", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64158", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.6417", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64178", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.0046", "scoring_system": "epss", "scoring_elements": "0.64191", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12802" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930510", "reference_id": "930510", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930510" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" } ], "aliases": [ "CVE-2019-12802" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ba9q-e289-ekbt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/195709?format=api", "vulnerability_id": "VCID-xype-sjmg-s3gz", "summary": "In radare2 before 3.7.0, a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-14745", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91476", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91482", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91489", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91497", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.9151", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91516", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91522", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91523", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91521", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91543", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91538", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91547", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91545", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.07084", "scoring_system": "epss", "scoring_elements": "0.91544", "published_at": "2026-04-29T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-14745" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934204", "reference_id": "934204", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934204" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/438237?format=api", "purl": "pkg:apk/alpine/radare2@3.9.0-r0?arch=aarch64&distroversion=v3.18&reponame=community", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" } ], "aliases": [ "CVE-2019-14745" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xype-sjmg-s3gz" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:apk/alpine/radare2@3.9.0-r0%3Farch=aarch64&distroversion=v3.18&reponame=community" }