it will be very kind if you find some time to help with this 🙂

Hey @Filip! There isn't a query for vulnerable software that can be run on the host since all of that processing happens on the Fleet side. The likely answer for this is going to be using some combination of the webhook and the REST API to get the data you need. Here's an example of a Tines story that grabs vulnerable software for a given host: https://www.tines.com/story-library/1159734/retrieve-software-vulnerabilities-from-fleet-for-a-given-host