Package Vulnerabilities
Known vulnerabilities for an open-source package version from OSV.dev (GitHub advisories, PyPI, npm, Go, Maven, crates.io...): id, CVE aliases, summary, severity, fixed versions, references. Plus what plain OSV lacks: CISA KEV 'exploited in the wild' flag + date, FIRST EPSS exploit probability, exploited/most-likely first, and one verified upgrade version that fixes every listed vuln. ~1 s.
Example request
curl -X POST https://radarbg.com/v1/osv-vulns \
-H "X-API-Key: YOUR_KEY" -H "Content-Type: application/json" \
-d '{"package": "lodash", "ecosystem": "npm", "version": "4.17.15", "maxItems": 50}'
Answer: {"ok": true, "count": N, "items": [...], "usage": {...}}. Failed calls are not counted.
Inputs
| Field | Type | Description |
|---|---|---|
package | string | Package name, e.g. lodash |
ecosystem | string | npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet |
version | string | Version, e.g. 4.17.15 (empty = all known) |
purl | string | Or a package URL, e.g. pkg:npm/lodash@4.17.15 |
maxItems | integer | Max results |
Price
Included in every plan: 100 calls a month free, then from €9 a month for 3,000 calls across all APIs.