Know when your
AI stack is exposed.

Returns advisories disclosed today or in the previous six UTC days. No key, install, or pagination. Pick a severity or a type to add a real server-side query filter; the endpoint accepts one filter at a time.

Loading recent advisories…

const response = await fetch('https://www.aidatahub.io/api/latest-security');
if (!response.ok) throw new Error(`Latest security: HTTP ${response.status}`);
const { advisories, status } = await response.json();
if (status !== 'ok') console.warn('A source check is delayed.');
console.log(advisories);

These examples call /api/latest-security directly. ?severity=critical, ?severity=high, ?type=exploited, ?type=advisory and ?type=incident filter at the API. Combining both filters or sending an unknown value returns HTTP 400.

Waiting for the feed.

02 / Follow what’s new

Alerts without the noise.

For a no-code option, add our RSS feed to your reader or an RSS-triggered automation. Titles are prefixed with [CRITICAL], [HIGH], [EXPLOITED], [INCIDENT] or [MALICIOUS PACKAGE] so you can route on severity. Initial history is excluded.

For reliable alerts, use the full history feed and download the tiny JavaScript client. Poll every 15 minutes. Save the first set of IDs without sending alerts. On later checks, process unseen advisories whose baseline is false.

import { FEED_URL, findNewAdvisories } from './security-advisories-client-v1.mjs';

// Your app supplies durable storage and notification delivery.
const savedIds = await loadSeenIds(); // null on first run; otherwise string[]
const response = await fetch(FEED_URL, { signal: AbortSignal.timeout(15000) });
if (!response.ok) throw new Error('Feed request failed');
const { advisories, seenIds } = findNewAdvisories(await response.json(), savedIds);
for (const advisory of advisories.filter(a => a.type === 'exploited' || a.severity === 'critical')) {
  await sendAlert(advisory); // deduplicate by advisory.id at your destination
}
await saveSeenIds(seenIds); // save only AFTER successful delivery

This integration outline requires your own loadSeenIds, sendAlert, and saveSeenIds functions. Persist IDs across restarts. A failed delivery must not advance the checkpoint; retries can repeat earlier deliveries, so the destination should also deduplicate by ID. Match affected[].name against your own dependency list to alert only on packages you run.

Send the last response’s ETag as If-None-Match on later requests. A 304 has no body: keep your previous data. On errors, retain your checkpoint and retry with backoff. The tiny client uses normal HTTP caching; custom conditional requests belong in your integration.

The simple endpoint returns generatedAt, from, through, severity, type, status, count, and advisories. Each advisory carries the identifiers, severity, score, affected package names, disclosure date, exploitation details and source link. An empty advisories array means no recognized advisories in that period. status: "degraded" means a required source check failed, or more than a fifth of the supplementary incident feeds did; inspect sources in the full feed for details. Check that generatedAt is recent before treating an empty result as complete.

Full history feed

Use /api/security-advisories.json for the 90-day archive, CVSS vectors, references, evidence, source health, and alert IDs. It returns the entire archive; query parameters do not filter it.

The response has schemaVersion: 1, generatedAt, initializedAt, pollIntervalSeconds, coverage, sources, and events. Optional links point to these docs, the schema, client, and RSS. Unknown additive fields should be ignored.

Events are ordered by disclosure date, newest first. They are not ordered by detection time. The feed contains the collected archive; it does not paginate.

JavaScript client options

getSecurityAdvisories({ severity, type, limit, since, signal }) fetches the feed and returns events, count, total, generatedAt, sources, and stale. HTTP errors and unsupported feeds throw. selectAdvisories(feed, options) filters an already loaded feed.

• severity: critical, high, medium, low, or unknown. Omit for all.
• type: all (default), advisory, exploited, or incident.
• limit: integer 1–1,000; default 10. total counts all matches before this limit.
• since: exclusive cutoff on publishedAt; ISO date or timestamp with timezone. Omit for all dates.
• signal: optional AbortSignal. Default timeout: 15 seconds.

04 / Know the limits

Evidence, with a heartbeat.

GitHub, CISA, OSV and the linked vendors and publications are the authoritative sources for every entry; incidents are reports to verify with the vendor before acting. AIDataHub is independent and is not endorsed by any of them.