Get Issues (Nixpkgs)

Retrieve a list of tracked CVE issues from nixpkgs security issues.

Data Source

This endpoint returns issues only from nixpkgs security issues, whoever filed them. For vulnerabilities in other ecosystems (npm, PyPI, Debian, etc.), use the OSV endpoint or CVE Matching endpoint.

Endpoint

GET /api/v1/issues

Response

{
  "success": true,
  "count": 88,
  "data": [
    {
      "id": "12345",
      "title": "CVE-2024-XXXX: openssl vulnerability description",
      "url": "https://github.com/NixOS/nixpkgs/issues/12345",
      "package": "openssl",
      "cveIds": ["CVE-2024-XXXX"],
      "severity": "high",
      "cvssScore": 8.1,
      "currentVersion": "3.1.4",
      "fixedVersion": "3.1.5",
      "createdAt": "2024-01-15T10:00:00Z",
      "assignees": ["maintainer1"],
      "dataSource": "nixpkgs-tracker",
      "isTracked": true,
      "difficulty": "easy"
    }
  ],
  "timestamp": "2026-02-10T12:00:00.000Z"
}

Response Fields

Issue Object

Field	Type	Description
id	string	GitHub issue number
title	string	Issue title, typically includes CVE ID and package
url	string	Direct link to the GitHub issue
package	string	Extracted affected package name
cveIds	string[]	CVE identifiers extracted from title and body
severity	string	Severity level: critical, high, medium, low, or unknown. Enriched from NVD CVSS data when available
cvssScore	number|undefined	CVSS v3.1 base score (present when severity is enriched from NVD)
currentVersion	string	Current vulnerable version extracted from title
fixedVersion	string	Fixed version extracted from body (empty string if unknown)
createdAt	string	ISO 8601 timestamp
assignees	string[]	GitHub usernames assigned to the issue
dataSource	string	Always nixpkgs-tracker
isTracked	boolean	Always true
difficulty	string	Estimated fix difficulty: easy, medium, or hard
number	number	The GitHub issue number (same value as id, typed as a number)
state	string	open or closed
filedBy	string	GitHub username or app that filed the issue
nixpkgsId	string|null	The NixOS security review's own id for the issue, when it filed one
nixpkgsAttrs	string[]	nixpkgs attributes the issue body names
packageSource	string	Where package came from: a confirmed attribute or a title guess
channelVersions	object	Per-channel version state as last observed
closedAt	string|null	ISO 8601 timestamp the issue closed, when closed
labels	string[]	GitHub labels on the issue
maintainers	string[]	nixpkgs maintainers of the attribute, distinct from assignees

Difficulty Estimation

Difficulty is computed from issue characteristics:

Difficulty	Criteria
easy	Upstream fix available, single package, simple version bump
medium	Patch backporting required, moderate staging coordination
hard	Vendored dependencies, multiple versions, mass rebuilds

Get Single Issue

GET /api/v1/issues/:id

Returns a single issue by GitHub issue number.

Examples

# Get all tracked issues
curl "https://api.vulnpatch.dev/api/v1/issues"

# Get a specific issue
curl "https://api.vulnpatch.dev/api/v1/issues/12345"

Code Examples

JavaScript

async function getIssues() {
  const response = await fetch('https://api.vulnpatch.dev/api/v1/issues');
  const { data } = await response.json();

  for (const issue of data) {
    console.log(`[${issue.severity}] ${issue.package}: ${issue.cveIds.join(', ')} (${issue.difficulty})`);
  }
}

Python

import requests

response = requests.get('https://api.vulnpatch.dev/api/v1/issues')
data = response.json()['data']

for issue in data:
    cves = ', '.join(issue['cveIds'])
    print(f"[{issue['severity']}] {issue['package']}: {cves} ({issue['difficulty']})")

Caching

This endpoint is cached for 1 hour. The X-Cache header indicates cache status.