> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# plerion vulnerabilities

> Query vulnerabilities and manage exemptions.

With **plerion vulnerabilities**, you can query vulnerabilities across your cloud assets and manage vulnerability exemptions.

<Tip>
  For more about vulnerabilities in the Plerion dashboard, see [Vulnerabilities](/guides/platform/vulnerabilities).
</Tip>

***

## Synopsis

```bash theme={"system"}
plerion vulnerabilities <subcommand> [options]
```

***

## Subcommands

### list

List vulnerabilities with filtering.

```bash theme={"system"}
plerion vulnerabilities list [options]
```

#### Options

| Flag | Type | Description |
| - | - | - |
| `--severity` | string | `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL` (comma-separated) |
| `--provider` | string | Cloud provider: `AWS`, `Azure`, `GCP`, `Kubernetes` (case-insensitive) |
| `--has-kev` | flag | Only CISA Known Exploited Vulnerabilities |
| `--has-exploit` | flag | Only vulnerabilities with known exploits |
| `--has-vendor-fix` | flag | Only vulnerabilities with a vendor fix available |
| `--is-exploitable` | flag | Only exploitable vulnerabilities |
| `--epss-score-gte` | number | Only vulnerabilities whose Exploit Prediction Scoring System (EPSS) score is at least this probability, from 0 to 1. `0.5` means a 50% chance of exploitation in the next 30 days. The value is sent as typed, so `0` returns every scored vulnerability. Unscored vulnerabilities never match |
| `--epss-score-lte` | number | Only vulnerabilities whose EPSS score is at most this probability, from 0 to 1. The value is sent as typed, so `1` returns every scored vulnerability. Must not be less than `--epss-score-gte` |
| `--has-epss-score` | boolean | Filter on whether the vulnerability has an EPSS score (`true` or `false`). `false` can't be combined with an EPSS score range |
| `--is-exempted` | boolean | Filter by exemption status (`true` or `false`) |
| `--asset-id` | string | Filter by asset ID(s) |
| `--vulnerability-id` | string | Filter by CVE/vulnerability IDs (comma-separated) |
| `--asset-group-id` | string | Filter by asset group IDs (comma-separated) |
| `--environment-id` | string | Filter by environment IDs or names (comma-separated) |
| `--execution-id` | string | Filter by execution IDs (comma-separated) |
| `--region` | string | Filter by cloud region(s) |
| `--integration-id` | string | Filter by integration IDs |
| `--sort-by` | string | Sort field: `hasKev`, `hasExploit`, `lastObservedAt`, `firstObservedAt`, `severityLevelValue` or `epssScore`. Sorting by `epssScore` puts unscored vulnerabilities last in either order |
| `--sort-order` | string | `asc` or `desc` |
| `--package-name` | string | Filter by package name |
| `--target-name` | string | Filter by target name |
| `--target-type` | string | Filter by target type |
| `--target-class` | string | Filter by target class (e.g. `lang-pkgs`, `os-pkgs`) |
| `--start` | string | First observed start date (ISO 8601) |
| `--end` | string | First observed end date (ISO 8601) |
| `--per-page` | number | Results per page (max 2000) |
| `--all` | flag | Fetch all pages automatically |

### exemptions list

```bash theme={"system"}
plerion vulnerabilities exemptions list --profile-id <id> [--per-page N] [--all]
```

List vulnerability exemptions for a profile.

| Flag | Type | Description |
| - | - | - |
| `--profile-id` | string | **(required)** Profile ID or `default` |
| `--per-page` | number | Results per page (default: 100, max: 1000) |
| `--all` | flag | Fetch all pages automatically |

### exemptions get

```bash theme={"system"}
plerion vulnerabilities exemptions get --profile-id <id> --id <exemption-id>
```

### exemptions create

```bash theme={"system"}
plerion vulnerabilities exemptions create --profile-id <id> --name <n> --reason <r> --conditions <json> --audit-note <note>
```

| Flag | Type | Description |
| - | - | - |
| `--reason` | string | **(required)** Exemption reason. Validated against allowed values (see below) |
| `--conditions` | string | **(required)** Conditions JSON. Must include at least one of: `vulnerabilityIds`, `assetGroupIds`, `assetIds`, `assetRegions`, `assetTags`. The EPSS conditions `epssScoreGte` and `epssScoreLte` (0 to 1) and `hasEpssScore` (`true` or `false`) can also be used on their own |
| `--audit-note` | string | **(required)** Audit note (max 250 chars) |

<Note>
  The `--conditions`, `--reason`, and `--audit-note` flags are all required when creating an exemption.
</Note>

#### Reason values

| Value | Description |
| - | - |
| `ACCEPTED_RISK` | Risk has been accepted |
| `COMPENSATING_CONTROL` | A compensating control is in place |
| `NO_VENDOR_FIX` | No vendor fix is available |
| `NOT_IN_USE` | The vulnerable component is not in use |
| `OTHER_REASONS` | Other reasons (provide details in name) |

### exemptions update

```bash theme={"system"}
plerion vulnerabilities exemptions update --profile-id <id> --id <exemption-id> [--name <n>] [--reason <r>] [--audit-note <note>] [--conditions <json>]
```

| Flag | Type | Description |
| - | - | - |
| `--audit-note` | string | Updated audit note |
| `--conditions` | string | Updated conditions (JSON). Replaces the existing conditions, with the same rules as `create` |

### exemptions delete

```bash theme={"system"}
plerion vulnerabilities exemptions delete --profile-id <id> --id <exemption-id>
```

***

## Examples

```bash theme={"system"}
# Critical vulnerabilities with known exploits
plerion vulnerabilities list --severity CRITICAL --has-exploit

# CISA KEV list
plerion vulnerabilities list --has-kev --output table

# All critical and high vulnerabilities
plerion vulnerabilities list --severity CRITICAL,HIGH --all --output json > vulns.json

# Vulnerabilities with at least a 10% chance of exploitation, highest EPSS score first
plerion vulnerabilities list --epss-score-gte 0.1 --sort-by epssScore --sort-order desc

# Create an exemption
plerion vulnerabilities exemptions create \
  --profile-id my-profile \
  --name "Accepted CVE-2022-22965" \
  --reason ACCEPTED_RISK \
  --conditions '{"vulnerabilityIds":["CVE-2022-22965"]}' \
  --audit-note "Accepted risk per security review"

# List exemptions
plerion vulnerabilities exemptions list --profile-id my-profile

# Fetch all exemptions across all pages
plerion vulnerabilities exemptions list --profile-id my-profile --all

# Delete an exemption
plerion vulnerabilities exemptions delete --profile-id my-profile --id ex-abc123
```

***

## Output columns

Table output includes all fields returned by the API:

| Column | Description |
| - | - |
| CVE / ID | CVE identifier or Plerion vulnerability ID |
| TITLE | Vulnerability title |
| SEVERITY | `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, `INFORMATIONAL` |
| SEVERITY VALUE | Numeric CVSS-style severity score |
| SEVERITY SOURCE | Source of the severity rating |
| PROVIDER | Cloud provider |
| ASSET ID | Affected asset ID |
| ASSET TYPE | Asset type |
| TARGET NAME | Affected package or target name |
| DESCRIPTION | Vulnerability description |
| PRIMARY URL | Link to CVE or advisory |
| KEV | CISA Known Exploited Vulnerability |
| EXPLOIT | Has known exploit |
| FIX | Vendor fix available |
| EPSS | EPSS score as a percentage, such as `94.3%`, `<0.1%` or `>99.9%`. Blank when the vulnerability has no score. Text output keeps the raw 0 to 1 value |
| EPSS DATE | Date FIRST published the EPSS score (`YYYY-MM-DD`). Blank when there is no score |
| PUBLISHED | Publication date |
| FIRST OBSERVED | First observed timestamp |
| LAST OBSERVED | Last observed timestamp |
| INTEGRATION ID | Integration ID |
| TENANT ID | Tenant ID |
| ORG ID | Organization ID |
| EXECUTION ID | Scan execution ID |
| SCHEMA VERSION | API schema version |

### Exemptions output columns

| Column | Description |
| - | - |
| ID | Exemption ID |
| PROFILE ID | Profile the exemption belongs to |
| NAME | Exemption name/description |
| REASON | Exemption reason |
| AUDIT NOTE | Auditor note |
| CREATED BY | User who created the exemption |
| UPDATED BY | User who last updated the exemption |
| CREATED AT | Creation timestamp |
| UPDATED AT | Update timestamp |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.