Recipes

Every recipe assumes VULNETIX_ORG_ID and VULNETIX_API_KEY are set (see the quickstart), and jq is installed. Each API call counts against your daily quota.

Fail a CI job when a pinned package has advisories

/v2/inputs/resolve turns a purl into the advisory ids that affect it, in one request:

#!/usr/bin/env bash
set -euo pipefail
PURL="${1:?usage: $0 pkg:npm/express@4.17.1}"

ids=$(curl -sf \
  -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  --get --data-urlencode "purl=${PURL}" \
  https://api.vdb.vulnetix.com/v2/inputs/resolve | jq -r '.resolved.vulnIds[]')

if [ -n "$ids" ]; then
  echo "$PURL is affected by:"
  echo "$ids"
  exit 1
fi
echo "$PURL: no known advisories"

For a whole repository, use vulnetix sca instead; it reads your manifests and lockfiles and applies your quality gate.

Check a list of CVEs against KEV

while read -r id; do
  [ -z "$id" ] && continue
  if out=$(vulnetix vdb kev get "$id" -o json --silent 2>/dev/null); then
    echo "$out" | jq -r '"\(.cveId)\tdue \(.dueDate)\toverdue=\(.overdue)\transomware=\(.knownRansomwareCampaignUse)"'
  else
    echo -e "${id}\tnot in KEV"
  fi
done < cves.txt

Count CVEs per version of a package

vulnetix vdb vulns express --limit 500 -o json --silent \
  | jq -r '.versions[] | "\(.version)\t\(.cveIds | length)"' \
  | sort -t$'\t' -k2 -n -r | head

.totalCVEs holds the number of distinct CVEs across every version.

Look up many advisories of mixed formats

# ids.txt: one id per line, any family (CVE, GHSA, PYSEC, RHSA, USN, ...)
while read -r id; do
  vulnetix vdb vuln "$id" -o json --silent > "vuln-${id//[:\/]/_}.json" || echo "failed: $id" >&2
done < ids.txt

Export the KEV catalogue

vulnetix vdb kev download -o kev.csv                         # Vulnetix KEV, CSV
vulnetix vdb kev list --source CISA --source enisa -o json --silent > kev.json
vulnetix vdb kev list --reason known_ransomware -o json --silent   # `vdb kev reasons` lists the values

Build a Snort or Suricata rule pack

vulnetix vdb snort-rules list --source vulnetix \
  --since 2026-10-01T00:00:00Z --limit 200 --format rules -o vulnetix.rules

--format rules writes the raw .rules text instead of JSON. The same works for YARA:

vulnetix vdb yara-rules list --tag ransomware --limit 200 --format rules -o ransomware.yar

Page through a month of CVE ids

for offset in 0 500 1000 1500; do
  vulnetix vdb ids 2024 3 --limit 500 --offset "$offset" -o json --silent | jq -r '.identifiers[]'
done

Stop when a page comes back with "hasMore": false. See Pagination.

Shell aliases

alias vv='vulnetix vdb vuln'
alias vx='vulnetix vdb exploits'
alias vf='vulnetix vdb fixes'