Recent Advisories

Get the count and details of security advisories published in the last 12 hours from GitHub Advisory Database.

Endpoint

GET /api/v1/recent-advisories

Response

{
  "success": true,
  "data": {
    "count": 7,
    "severityCounts": {
      "critical": 2,
      "high": 1,
      "medium": 2,
      "low": 2,
      "unknown": 0
    },
    "latest": [
      {
        "ghsa_id": "GHSA-4486-gxhx-5mg7",
        "severity": "medium",
        "summary": "PsySH has Local Privilege Escalation via CWD .psysh.php auto-load",
        "published_at": "2026-01-30T21:28:44Z"
      }
    ]
  },
  "timestamp": "2026-01-30T12:00:00.000Z"
}

Response Fields

Field	Type	Description
count	number	Total advisories published in last 12 hours
severityCounts	object	Breakdown by severity level
latest	array	Most recent 5 advisories with details
advisories	array	Returned advisories in the window, up to one upstream page
countCapped	boolean	When true, the count is a lower bound
latestBackfilled	boolean	The preview includes older records to fill a quiet window

Severity Counts Object

Field	Type	Description
critical	number	Count of critical severity advisories
high	number	Count of high severity advisories
medium	number	Count of medium severity advisories
low	number	Count of low severity advisories
unknown	number	Count of advisories without severity rating

Latest Advisory Object

Field	Type	Description
ghsa_id	string	GitHub Security Advisory ID (e.g., GHSA-xxxx-xxxx-xxxx)
severity	string	Severity level: critical, high, medium, low, or unknown
summary	string	Brief description of the vulnerability
published_at	string	GitHub advisory publication time, not necessarily the CVE record's publication time
source	string	github-advisories, the source of this feed
ecosystems	string[]	Distinct package ecosystems reported by GitHub; empty when unreported

Both latest and advisories include source and ecosystem metadata. An empty ecosystem list does not mean the advisory affects every ecosystem. The CVE site's filters use the returned collection before limiting the preview to twelve rows. The response timestamp records when this cached snapshot was fetched. The cache lasts up to ten minutes; this endpoint is a polled feed, not a stream.

Example

curl https://api.vulnpatch.dev/api/v1/recent-advisories

Code Examples

JavaScript

async function getRecentAdvisories() {
  const response = await fetch('https://api.vulnpatch.dev/api/v1/recent-advisories');
  const { data } = await response.json();

  console.log(`${data.count} new advisories in the last 12 hours`);
  console.log(`Critical: ${data.severityCounts.critical}`);
  console.log(`High: ${data.severityCounts.high}`);

  console.log('\nLatest advisories:');
  for (const adv of data.latest) {
    console.log(`  [${adv.severity.toUpperCase()}] ${adv.summary}`);
  }
}

Python

import requests

response = requests.get('https://api.vulnpatch.dev/api/v1/recent-advisories')
data = response.json()['data']

print(f"{data['count']} new advisories in the last 12 hours")
print(f"Critical: {data['severityCounts']['critical']}")
print(f"High: {data['severityCounts']['high']}")

print("\nLatest advisories:")
for adv in data['latest']:
    print(f"  [{adv['severity'].upper()}] {adv['summary']}")

Use Cases

• Security dashboards: Display real-time vulnerability alerts
• Notification systems: Trigger alerts on new critical advisories
• Landing pages: Show "X new vulnerabilities today" stats
• Monitoring: Track daily vulnerability disclosure rates

Data Source

This endpoint aggregates data from the GitHub Advisory Database, which includes:

• CVEs from the NVD
• GitHub Security Advisories (GHSA)
• npm, PyPI, Maven, and other ecosystem advisories

Caching

This endpoint is cached for 1 hour to balance freshness with API rate limits. The X-Cache header indicates cache status.