List Vulnerabilities
Vuln List V1 API
Lists the current vulnerabilities of a recent scan. This API returns vulnerabilities with failed compliance status and with rejected or expired false positive requests. In the API output, we show the vulnerability ID (which will be further used to raise False Positive request), title, PCI compliant status, severity, host IP address, DNS host, last scanned date, and false positive status.
Permissions required - You must have an active PCI merchant account.
The following table mentions the EOS and EOL Timelines for Vuln List V1 API.
| End of Support (EOS) | February 2026 |
| End of Life (EOL) | August 2026 |
To learn more about EOS and EOL, refer EOS and EOL for Versioned APIs.
Input ParametersInput Parameters
The input parameters to filter the vulnerabilities.
|
Parameter |
Description |
|---|---|
|
sortBy={title|severity|ip|scandate} |
(Optional) Specify how you want to organize the results. One of: "host IP address", "scan date", "vulnerability's title", "severity". If you do not specify any value, then vulnerabilities will be sorted by host IP address. |
|
sortOrder={asc|desc} |
(Optional) The sort order, used when the request includes the sortBy parameter. One of: asc (for ascending order) or desc (for descending order). If you do not specify any value, then vulnerabilities will be sorted in descending order. |
|
limit={value} |
(Optional) The maximum number of records processed for the request, starting at the record number specified by the offset parameter. Limit value must always be greater than “0”. If you specify a value 0 for the parameter, the request will fail. When not specified, default limit is set to 100 scan records. You can specify a value less than or greater than the default. Maximum limit value that you can specify is 1000. |
|
offset={value} |
(Optional) The starting scan record number. |
|
ip={value} |
(Optional) Show vulnerabilities for only certain IP addresses. One or more IPs/ranges may be specified. Multiple entries are comma separated. A host IP range is specified with a hyphen (for example, 10.10.10.44-10.10.10.90). |
|
dns={value} |
(Optional) Show vulnerabilities for a DNS host. For example, 205-189-240-1.bogus.tld. |
|
title={value} |
(Optional) Show vulnerabilities for a vulnerability title. You can search vulnerability title by keywords. |
|
qid={value} |
(Optional) Show vulnerabilities for a vulnerability ID (QID). For example, 115731. |
|
severity={POTENTIAL_HIGH| POTENTIAL_MED|POTENTIAL_LOW| CONFIRMED_HIGH|CONFIRMED_MED| CONFIRMED_LOW} |
(Optional) Show vulnerabilities for certain severity. You can search for potential and confirmed vulnerability with high, medium and low severity. Multiple entries are comma separated. To filter vulnerabilities for multiple severities, use comma to separate the values: "severity=CONFIRMED_MED, POTENTIAL_MED, POTENTIAL_HIGH". |
|
falsePositive={Requested, Rejected, Expired} |
(Optional) Show vulnerabilities with certain false positive request status. Multiple entries are comma separated. To filter vulnerabilities for multiple false positive values, use comma to separate the values: "falsePositive=Requested, Rejected, Expired". |
|
pciFailVulns={0|1/true|false} |
(Optional) When set to true or 1, we will show you the vulnerabilities with failed PCI Compliance status. When set to false or 0, we will show all the vulnerabilities irrespective of their compliance status. Default value of the parameter is false. |
|
fpSubmissionList={0|1/true|false} |
(Optional) Specify true or 1 to show a sample JSON body with all the IDs for PCI fail vulnerabilities for which you can submit false positive requests. This means you do not have to copy each ID from the API output to prepare a JSON payload to submit false positive request. The pciFailVulns parameter must be set to true if this parameter is true. |
Sample - List vulnerabilitiesSample - List vulnerabilities
Let us list vulnerabilities with severity as confirmed medium and potential medium and PCI compliance status as fail.
API request
curl -H "X-Requested-With: test"
-u "USERNAME:PASSWD"
-X GET -H "content-type: application/json"
-H "apiVersion:V1"
"https://pci-api.qualys.com/pci/vuln/list?limit=10&sortOrder=desc&sortBy=severity&
offset=1& limit=10&severity=CONFIRMED_MED,POTENTIAL_MED,POTENTIAL_HIGH&pciFailVulns=true";
JSON response
{
"responseApiVersion": "LATEST - V1",
"data":
{
"totalCount": 7306,
"fetchRange": "1-10",
"merchantVulnList":
[
{
"id": 636136,
"qid": 110033,
"title": "Microsoft Office 2003 SP2 Missing",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.220",
"dns": "10-10-2-220.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 617316,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.109",
"dns": "10-10-2-109.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 614872,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.92",
"dns": "10-10-2-92.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 614400,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.88",
"dns": "10-10-2-88.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 614392,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.88",
"dns": "10-10-2-88.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 611910,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.74",
"dns": "10-10-2-74.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 611891,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.74",
"dns": "10-10-2-74.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 608954,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.52",
"dns": "10-10-2-52.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 607120,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.39",
"dns": "10-10-2-39.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
},
{
"id": 607109,
"qid": 86473,
"title": "Web Server HTTP Trace/Track Method Support Cross-Site Tracing Vulnerability",
"pciCompliant": "Fail",
"severity": "Confirmed Medium",
"ip": "10.10.2.39",
"dns": "10-10-2-39.bogus.tld",
"dateLastScanned": "10/07/14",
"fpStatus": "NA"
}
]
}
}
Vuln List V2 API
With the introduction of versioning in the PCI Compliance APIs, we have released V2 of this API to provide a more accurate response when no vulnerabilities are found in a PCI Merchant account. The V2 API includes this enhancement while continuing to support all the existing features available with V1 API.
We have updated the Vulnerability List API to display the list of vulnerabilities detected during a scan. The Vulnerability List API now shows the list of vulnerabilities detected in the TAS/WAS scan.
We have also added support to sort the vulnerabilities based on their scan module by adding a new sorting criterion, sortBy=scanModule.
Permissions required - You must have an active PCI merchant account.
Sample: Generate the list of Vulnerabilities for PCI Merchant AccountSample: Generate the list of Vulnerabilities for PCI Merchant Account
API Request
curl -X GET 'localhost:8080/pci/vuln/list?' -H 'Content-Type: application/json apiVersion: V2'
API Response
{
"responseApiVersion": "V2",
"data": {
"totalCount": 0,
"merchantVulnList": []
}
}
Sample - Fetch the Vulnerabilities List with Scan Module DataSample - Fetch the Vulnerabilities List with Scan Module Data
This sample illustrates using the Vulnerabilities List API to fetch the vulnerabilities detected during the TAS/WAS Scan.
API Request
curl -H "X-Requested-With: test"
-u "USERNAME:PASSWD"
-X GET -H "content-type: application/json"
-H "apiVersion:V1"
"https://pci-api.qualys.com/pci/vuln/list?limit=10&sortOrder=desc&sortBy=severity&
offset=1& limit=10&severity=CONFIRMED_MED,POTENTIAL_MED,POTENTIAL_HIGH&pciFailVulns=true";
API Response
{
"responseApiVersion": "V1",
"data": {
"totalCount": 2863,
"fetchRange": "1-3",
"merchantVulnList": [
{
"id": 1361081,
"qid": 82003,
"title": "ICMP Timestamp Request",
"pciCompliant": "Pass",
"severity": "Confirmed Low",
"ip": "11.11.11.11",
"dns": null,
"dateLastScanned": "08/21/2025",
"fpStatus": "NA",
"scanModule": "WAS"
},
{
"id": 1361125,
"qid": 82003,
"title": "ICMP Timestamp Request",
"pciCompliant": "Pass",
"severity": "Confirmed Low",
"ip": "87.87.1.6",
"dns": null,
"dateLastScanned": "09/02/2025",
"fpStatus": "NA",
"scanModule": "WAS"
},
{
"id": 1361121,
"qid": 82003,
"title": "ICMP Timestamp Request",
"pciCompliant": "Pass",
"severity": "Confirmed Low",
"ip": "87.87.1.1",
"dns": null,
"dateLastScanned": "09/02/2025",
"fpStatus": "NA",
"scanModule": "WAS"
}
]
}
}