Trending Vulnerabilities

This week's new GitHub security advisories, ranked by exploitation risk, not by weaponization evidence: an entry naming a real CVE id sorts before one that only has a GHSA id, then CISA KEV status, then EPSS score, then severity as a final tiebreak. An entry with no actual exploit signals can appear here; its own CVE dossier's exploitSignals block is the place to check for that.

Endpoint

GET /api/v1/trending

Response

{
  "success": true,
  "data": {
    "trending": [
      {
        "id": "GHSA-qhwx-74w5-xhxq",
        "cve_id": "CVE-2026-92948",
        "summary": "vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape",
        "severity": "critical",
        "severitySource": "github",
        "updated_at": "2026-10-01T15:41:32Z",
        "ecosystem": "npm",
        "epss": 0.00654,
        "percentile": 0.49575,
        "inKev": false,
        "verdict": "rated_high_unlikely",
        "conflict": true,
        "verdictDetail": "Rated critical, but exploitation is unlikely at 0.7%."
      }
    ],
    "count": 50,
    "countCapped": false
  },
  "timestamp": "2026-10-05T12:00:00.000Z"
}

• severity / severitySource: with severitySource: "github", GitHub's own advisory rating, not this database's canonical severity (CNA/NVD/GitHub/CISA ADP precedence, computed per CVE in the dossier). The two can disagree; check the CVE's own dossier for the canonical value. GitHub rates nothing it holds no CVSS for and sends "unknown"; when this database's cached CVE record already carries a rating for that CVE, the entry takes it and severitySource names the record's own source instead: "cve_list_v5" (the CNA's score), "cisa_adp" (CISA's stand-in), "osv" or "github" (the record's own fallbacks). Only the cache is consulted, so an entry can still be "unknown" with severitySource: "github": it is unrated, not a fifth level.
• ecosystem: the package registry GitHub attributes the advisory to, or null when it attributes none (its unreviewed, NVD-sourced entries, which are most of any week). null is an absence, not a registry; render nothing.
• epss / percentile: absent when FIRST has not scored the CVE yet, or when FIRST could not be reached this request — epssChecked: false and verdictDetail distinguish the second case.
• inKev: absent (with kevChecked: false) when the KEV catalogue could not be read this request, rather than defaulting to "not listed".
• verdict / conflict / verdictDetail: from assessConflict (packages/vulnpatch-core/src/score-conflict.js) — says when severity and predicted exploitation likelihood disagree, rather than showing severity alone.
• countCapped: true when GitHub's page cap (100) may be hiding more of the week than this response shows.
• An entry without a cve_id is a GHSA-only advisory; the UI gives it a working link to the GitHub advisory, never a broken CVE link.

Example

curl https://api.vulnpatch.dev/api/v1/trending

Use Cases

• Security dashboards: Display recent vulnerability activity
• Alerting: Monitor for new high-severity, high-likelihood vulnerabilities
• News feeds: Show latest security advisories

Caching

Results are cached for 30 minutes. On a GitHub outage or an empty window, the last known-good list is served instead (X-Cache: STALE) rather than failing outright.