cisco-psirt-advisories

Read the version from the device with 'show version' via pyATS or a CLI driver, then call check_version with ostype 'iosxe' and the version string. The API returns matching PSIRT advisories with severity and CVSS scores.

Use check_versions with a list of devices, each with name, ostype, and version. It de-duplicates by version first, so 60 devices on 12 versions cost only 12 API calls instead of 60, staying within the 30 calls/minute limit.

No, IOS-XR is not a supported OSType on this API and returns HTTP 404 for every version tested. For IOS-XR, fall back to check_cve or advisory lookup by product ID instead of per-version checking.

PSIRT answers whether a Cisco version is affected by a Cisco-published advisory, while NVD describes the CVE itself across all vendors. Either can be empty while the other has data, so check both for security questions.

The 'none_published' outcome only means Cisco has published nothing matching that exact version string. It says nothing about unpublished issues or configuration weaknesses, and 'normalisation_failed' or 'api_error' mean nothing was checked at all.

The API allows 5 calls per second and 30 calls per minute, shared across all callers of the credential. The server handles pacing, caching for 6 hours, and backoff on 429 responses automatically.