VulDB API

Overview

Measurement Record

What actually happened when we called this API from our own infrastructure. Every value below was recorded by the request, not copied from the provider's documentation.

Request

GET https://vuldb.com/?api

Result

HTTP 200 · application/json · 379 bytes · compressed

Response time

436 ms (median of 3) · fastest 402 ms

Transport

TLSv1.3 · TLS_AES_256_GCM_SHA384 · certificate issued by Google Trust Services

Browser CORS

Allowed — Access-Control-Allow-Origin: *

Served by

cloudflare

Recorded

2026-08-10

Fields Returned

Top-level fields present in the response we captured, with the type and value we actually received.

Captured Response

Captured from a real request to https://vuldb.com/?api on 2026-08-10. Long arrays and nested objects are truncated to keep the shape readable.

{
  "response": {
    "version": "3.87",
    "format": "json",
    "status": "401",
    "lang": "en",
    "error": "API key wrong format (missing)",
    "querylimitmax": 0,
    "timestamp": "1786391617",
    "rtt": 0,
    "etag": "4a5d-0de5-dcca"
  },
  "request": {
    "timestamp": "1786391617",
    "apikey": "missing"
  }
}

Implementation Example

Request skeleton. The URL below is this API's documentation page, not a live endpoint — swap in the path you need from the provider's docs before running it.

const url = "https://vuldb.com/";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

import requests

url = "https://vuldb.com/"
headers = {"X-API-Key": "YOUR_API_KEY"}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
data = response.json()
print(data)

curl -H "X-VulDB-ApiKey: YOUR_API_KEY" "https://vuldb.com/?api"

What Can You Build?

// Scan for security threats
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const target = 'example.com';
const response = await fetch(`https://vuldb.com/?doc.api`, { headers });
const data = await response.json();
console.log('Security scan result:', data);
const threats = data.threats || data.results || data;
console.log('Threat level:', threats.level || threats.risk || 'Check manually');

// Fetch vulnerability reports
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const response = await fetch(`https://vuldb.com/?doc.api`, { headers });
const data = await response.json();
const vulns = data.vulnerabilities || data.results || data.data || [];
const items = Array.isArray(vulns) ? vulns : [vulns];
items.slice(0, 5).forEach(v => {
  console.log(`⚠️ ${v.name || v.cve || v.id}: ${v.severity || v.risk || 'Unknown'}`);
});

// Perform a security check
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const response = await fetch(`https://vuldb.com/?doc.api`, { headers });
const report = await response.json();
console.log('Security report from VulDB:', report);
const score = report.score || report.grade || 'N/A';
console.log('Security score:', score);
document.getElementById('security-score').textContent = `Score: ${score}`;

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

How This API Fails

We deliberately sent this API a broken request and recorded exactly what came back on 2026-08-10. Knowing the shape of an error before you hit it makes error handling much easier to write.

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.