From dc40ea8289285a1ab0af19eeb5fdc4acea70befb Mon Sep 17 00:00:00 2001
From: ziad hany <ziadhany2016@gmail.com>
Date: Sat, 21 Feb 2026 02:35:05 +0200
Subject: [PATCH 1/3] Add API support for Patch/PackageCommitPatch

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
---
 vulnerabilities/models.py                     | 16 +++++
 .../templates/advisory_detail.html            | 34 ++++++++++-
 .../templates/advisory_package_details.html   | 61 +++++++++++++++++++
 3 files changed, 109 insertions(+), 2 deletions(-)

diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py
index 4efc04766..bebcdcaaf 100644
--- a/vulnerabilities/models.py
+++ b/vulnerabilities/models.py
@@ -73,6 +73,8 @@
 from vulnerabilities.severity_systems import EPSS
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
 from vulnerabilities.utils import compute_patch_checksum
+from vulnerabilities.utils import generate_commit_url
+from vulnerabilities.utils import generate_patch_url
 from vulnerabilities.utils import normalize_list
 from vulnerabilities.utils import normalize_purl
 from vulnerabilities.utils import normalize_text
@@ -2857,6 +2859,20 @@ class PackageCommitPatch(models.Model):
     patch_text = models.TextField(blank=True, null=True)
     patch_checksum = models.CharField(max_length=128, blank=True, null=True)
 
+    @property
+    def commit_url(self):
+        """
+        Generates Commit URL using the VCS URL and Commit Hash.
+        """
+        return generate_commit_url(self.vcs_url, self.commit_hash)
+
+    @property
+    def patch_url(self):
+        """
+        Generates Patch URL using the VCS URL and Commit Hash.
+        """
+        return generate_patch_url(self.vcs_url, self.commit_hash)
+
     def save(self, *args, **kwargs):
         if self.patch_text:
             self.patch_checksum = compute_patch_checksum(self.patch_text)
diff --git a/vulnerabilities/templates/advisory_detail.html b/vulnerabilities/templates/advisory_detail.html
index 90f1d6d8b..08ea8d572 100644
--- a/vulnerabilities/templates/advisory_detail.html
+++ b/vulnerabilities/templates/advisory_detail.html
@@ -80,7 +80,16 @@
                         </a>
                     </li>
                 {% endif %}
-
+            
+                <li data-tab="patch-url">
+                    <a>
+                        <span>
+                            {% with pcp_length=package_commit_patches|length %}
+                               Patches: ({{ advisory.patches.count|add:pcp_length }})
+                            {% endwith %}
+                        </span>
+                    </a>
+                </li>
                 <!-- <li data-tab="history">
                     <a>
                         <span>
@@ -436,7 +445,6 @@
                     </tr>
                 {% endfor %}
             </div>
-
         
             <div class="tab-div content" data-content="epss">
                 {% if epss_data %}
@@ -503,6 +511,28 @@
                 {% endif %}
             </div>
 
+            <div class="tab-div content" data-content="patch-url">
+                <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
+                    <thead>
+                        <tr>
+                            <th style="width: 250px;"> Patch URL </th>
+                        </tr>
+                    </thead>
+                    {% for patch in patches %}
+                    <tr>
+                        <td class="wrap-strings"><a href="{{ patch.patch_url }}" target="_blank">{{ patch.patch_url }}<i
+                                    class="fa fa-external-link fa_link_custom"></i></a></td>
+                    </tr>
+                    {% empty %}
+                    <tr>
+                        <td colspan="2">
+                            There are no known patches.
+                        </td>
+                    </tr>
+                    {% endfor %}
+                </table>
+            </div>
+            
             <div class="tab-div content" data-content="severities-vectors">
                 {% for severity_vector in severity_vectors %}
                     {% if severity_vector.vector.version == '2.0'  %}
diff --git a/vulnerabilities/templates/advisory_package_details.html b/vulnerabilities/templates/advisory_package_details.html
index 234c5bae0..531a88432 100644
--- a/vulnerabilities/templates/advisory_package_details.html
+++ b/vulnerabilities/templates/advisory_package_details.html
@@ -60,6 +60,67 @@
                 </div>
         </div>
     </section>
+    <section class="section pt-0">
+        <div class="details-container">
+            <article class="panel is-info panel-header-only">
+                <div class="panel-heading py-2 is-size-6">
+                    Vulnerable and Fixing Package Commit Patch details for Advisory:
+                    <span class="tag is-white custom">
+                        {{ advisoryv2.advisory_id }}
+                    </span>
+                </div>
+            </article>
+        
+        <div id="tab-content">
+            <table class="table vcio-table width-100-pct mt-2">
+                <thead>
+                    <tr>
+                        <th style="width: 50%;">Introduced in</th>
+                        <th>Fixed by</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for impact in advisoryv2.impacted_packages.all %}
+                        
+                        {% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
+                            <tr>
+                                <td>
+                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">
+                                        {{ pkg_commit_patch.vcs_url }}@{{ pkg_commit_patch.commit_hash }}
+                                    </a>
+                                    <br />
+                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
+                                </td>
+                                <td></td>
+                            </tr>
+                        {% endfor %}
+                        
+                        {% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
+                            <tr>
+                                <td></td>
+                                <td>
+                                    <a href="{{ pkg_commit_patch.commit_url }}" target="_self">
+                                        {{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
+                                    </a>
+                                    <br />
+                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
+                                </td>
+                            </tr>
+                        {% endfor %}
+        
+                    {% empty %}
+                        <tr>
+                            <td colspan="2">
+                                This vulnerability is not known to affect any package commits.
+                            </td>
+                        </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+        
+        </div>
+    </section>
 {% endif %}
 
 <script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>

From 645d9cc0a3bc5df1431c6eb8b00738451a931117 Mon Sep 17 00:00:00 2001
From: ziad hany <ziadhany2016@gmail.com>
Date: Wed, 4 Mar 2026 23:12:08 +0200
Subject: [PATCH 2/3] Update UI to have a new tab `Package Commit Patches
 Details` Sort PackageCommitPatchViewSet

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
---
 .../templates/advisory_detail.html            | 12 +++
 .../advisory_package_commit_details.html      | 82 +++++++++++++++++++
 .../templates/advisory_package_details.html   | 61 --------------
 vulnerablecode/urls.py                        |  6 ++
 4 files changed, 100 insertions(+), 61 deletions(-)
 create mode 100644 vulnerabilities/templates/advisory_package_commit_details.html

diff --git a/vulnerabilities/templates/advisory_detail.html b/vulnerabilities/templates/advisory_detail.html
index 08ea8d572..acf3d9379 100644
--- a/vulnerabilities/templates/advisory_detail.html
+++ b/vulnerabilities/templates/advisory_detail.html
@@ -193,6 +193,18 @@
                                     </a>
                                 </td>
                             </tr>
+                            <tr>
+                                <td class="two-col-left"
+                                    data-tooltip="Risk expressed as a number ranging from 0 to 10. It is calculated by multiplying
+                                    the weighted severity and exploitability values, capped at a maximum of 10.
+                                    "
+                                >Introduced and Fixed Package Commit Patches</td>
+                                <td class="two-col-right wrap-strings">
+                                    <a href="/advisories/commits/{{ advisory.avid }}">
+                                         Package Commit Patches Details
+                                    </a>
+                                </td>
+                            </tr>
                         </tbody>
                     </table>
                     <div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-6">
diff --git a/vulnerabilities/templates/advisory_package_commit_details.html b/vulnerabilities/templates/advisory_package_commit_details.html
new file mode 100644
index 000000000..ae87a1870
--- /dev/null
+++ b/vulnerabilities/templates/advisory_package_commit_details.html
@@ -0,0 +1,82 @@
+{% extends "base.html" %}
+{% load humanize %}
+{% load widget_tweaks %}
+{% load static %}
+{% load show_cvss %}
+{% load url_filters %}
+
+{% block title %}
+VulnerableCode Advisory Package Commit Patch Details - {{ advisoryv2.advisory_id }}
+{% endblock %}
+
+{% block content %}
+
+{% if advisoryv2 %}
+    <section class="section pt-0">
+        <div class="details-container">
+            <article class="panel is-info panel-header-only">
+                <div class="panel-heading py-2 is-size-6">
+                    Introduce and Fixing Package Commit Patch details for Advisory:
+                    <span class="tag is-white custom">
+                        {{ advisoryv2.advisory_id }}
+                    </span>
+                </div>
+            </article>
+
+        <div id="tab-content">
+            <table class="table vcio-table width-100-pct mt-2">
+                <thead>
+                    <tr>
+                        <th style="width: 50%;">Introduced in</th>
+                        <th>Fixed by</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {% for impact in advisoryv2.impacted_packages.all %}
+                        {% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
+                            <tr>
+                                <td>
+                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">
+                                        {{ pkg_commit_patch.vcs_url }}@{{ pkg_commit_patch.commit_hash }}
+                                    </a>
+                                    <br />
+                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
+                                </td>
+                                <td></td>
+                            </tr>
+                        {% endfor %}
+
+                        {% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
+                            <tr>
+                                <td></td>
+                                <td>
+                                    <a href="{{ pkg_commit_patch.commit_url }}" target="_self">
+                                        {{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
+                                    </a>
+                                    <br />
+                                
+                                    {% if pkg_commit_patch.patch_url %}
+                                        <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        {% endfor %}
+
+                    {% empty %}
+                        <tr>
+                            <td colspan="2">
+                                This vulnerability is not known to affect any package commits.
+                            </td>
+                        </tr>
+                    {% endfor %}
+                </tbody>
+            </table>
+        </div>
+
+        </div>
+    </section>
+{% endif %}
+
+<script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>
+
+{% endblock %}
\ No newline at end of file
diff --git a/vulnerabilities/templates/advisory_package_details.html b/vulnerabilities/templates/advisory_package_details.html
index 531a88432..234c5bae0 100644
--- a/vulnerabilities/templates/advisory_package_details.html
+++ b/vulnerabilities/templates/advisory_package_details.html
@@ -60,67 +60,6 @@
                 </div>
         </div>
     </section>
-    <section class="section pt-0">
-        <div class="details-container">
-            <article class="panel is-info panel-header-only">
-                <div class="panel-heading py-2 is-size-6">
-                    Vulnerable and Fixing Package Commit Patch details for Advisory:
-                    <span class="tag is-white custom">
-                        {{ advisoryv2.advisory_id }}
-                    </span>
-                </div>
-            </article>
-        
-        <div id="tab-content">
-            <table class="table vcio-table width-100-pct mt-2">
-                <thead>
-                    <tr>
-                        <th style="width: 50%;">Introduced in</th>
-                        <th>Fixed by</th>
-                    </tr>
-                </thead>
-                <tbody>
-                    {% for impact in advisoryv2.impacted_packages.all %}
-                        
-                        {% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
-                            <tr>
-                                <td>
-                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">
-                                        {{ pkg_commit_patch.vcs_url }}@{{ pkg_commit_patch.commit_hash }}
-                                    </a>
-                                    <br />
-                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
-                                </td>
-                                <td></td>
-                            </tr>
-                        {% endfor %}
-                        
-                        {% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
-                            <tr>
-                                <td></td>
-                                <td>
-                                    <a href="{{ pkg_commit_patch.commit_url }}" target="_self">
-                                        {{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
-                                    </a>
-                                    <br />
-                                    <a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
-                                </td>
-                            </tr>
-                        {% endfor %}
-        
-                    {% empty %}
-                        <tr>
-                            <td colspan="2">
-                                This vulnerability is not known to affect any package commits.
-                            </td>
-                        </tr>
-                    {% endfor %}
-                </tbody>
-            </table>
-        </div>
-        
-        </div>
-    </section>
 {% endif %}
 
 <script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>
diff --git a/vulnerablecode/urls.py b/vulnerablecode/urls.py
index eb1bc006b..e9d56f75d 100644
--- a/vulnerablecode/urls.py
+++ b/vulnerablecode/urls.py
@@ -31,6 +31,7 @@
 from vulnerabilities.api_v3 import PackageV3ViewSet
 from vulnerabilities.views import AdminLoginView
 from vulnerabilities.views import AdvisoryDetails
+from vulnerabilities.views import AdvisoryPackageCommitPatchDetails
 from vulnerabilities.views import AdvisoryPackagesDetails
 from vulnerabilities.views import AffectedByAdvisoriesListView
 from vulnerabilities.views import ApiUserCreateView
@@ -119,6 +120,11 @@ def __init__(self, *args, **kwargs):
         AdvisoryPackagesDetails.as_view(),
         name="advisory_package_details",
     ),
+    path(
+        "advisories/commits/<path:avid>",
+        AdvisoryPackageCommitPatchDetails.as_view(),
+        name="advisory_package_commit_details",
+    ),
     path(
         "advisories/<path:avid>",
         AdvisoryDetails.as_view(),

From 227c0dfeba3eaf4fa25b27480fc57ddd92e2ccd2 Mon Sep 17 00:00:00 2001
From: ziad hany <ziadhany2016@gmail.com>
Date: Tue, 5 May 2026 14:26:00 +0300
Subject: [PATCH 3/3] Resolve merge migration conflict

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
---
 vulnerabilities/api_v3.py            | 106 ++++++++++++++++++++
 vulnerabilities/tests/test_api_v2.py | 142 +++++++++++++++++++++++++++
 vulnerabilities/utils.py             |  49 +++++++++
 vulnerabilities/views.py             |  52 ++++++++++
 vulnerablecode/urls.py               |   7 ++
 5 files changed, 356 insertions(+)

diff --git a/vulnerabilities/api_v3.py b/vulnerabilities/api_v3.py
index 12f10ed1c..5a516e5b4 100644
--- a/vulnerabilities/api_v3.py
+++ b/vulnerabilities/api_v3.py
@@ -15,6 +15,7 @@
 from django.db.models import Max
 from django.db.models import OuterRef
 from django.db.models import Prefetch
+from django.db.models import Q
 from django_filters import rest_framework as filters
 from drf_spectacular.utils import extend_schema
 from packageurl import PackageURL
@@ -33,7 +34,9 @@
 from vulnerabilities.models import Group
 from vulnerabilities.models import GroupedAdvisory
 from vulnerabilities.models import ImpactedPackageAffecting
+from vulnerabilities.models import PackageCommitPatch
 from vulnerabilities.models import PackageV2
+from vulnerabilities.models import Patch
 from vulnerabilities.throttling import PermissionBasedUserRateThrottle
 from vulnerabilities.utils import TYPES_WITH_MULTIPLE_IMPORTERS
 from vulnerabilities.utils import get_advisories_from_groups
@@ -386,6 +389,48 @@ def get_latest_non_vulnerable_version(self, package):
             return latest_non_vulnerable.version
 
 
+class PackageCommitPatchSerializer(serializers.ModelSerializer):
+    introduced_in_advisories = serializers.SerializerMethodField()
+    fixed_in_advisories = serializers.SerializerMethodField()
+
+    class Meta:
+        model = PackageCommitPatch
+        fields = [
+            "commit_hash",
+            "vcs_url",
+            "commit_url",
+            "patch_url",
+            "introduced_in_advisories",
+            "fixed_in_advisories",
+        ]
+
+    def get_introduced_in_advisories(self, obj):
+        impacts = obj.introduced_in_impacts.all()
+        return self.serialize_impacts(impacts)
+
+    def get_fixed_in_advisories(self, obj):
+        impacts = obj.fixed_in_impacts.all()
+        return self.serialize_impacts(impacts)
+
+    @staticmethod
+    def serialize_impacts(impacts):
+        unique_pairs = set()
+        for impact in impacts:
+            unique_pairs.add((impact.base_purl, impact.advisory.avid))
+        return [{"purl": base_purl, "avid": avid} for base_purl, avid in unique_pairs]
+
+
+class PatchSerializer(serializers.ModelSerializer):
+    in_advisories = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Patch
+        fields = ["patch_url", "in_advisories"]
+
+    def get_in_advisories(self, obj):
+        return [advisory.avid for advisory in obj.advisories.all()]
+
+
 class PackageV3ViewSet(viewsets.GenericViewSet):
     queryset = PackageV2.objects.all()
     serializer_class = PackageV3Serializer
@@ -558,6 +603,67 @@ def get_queryset(self):
         return AdvisoryV2.objects.filter(**{self.relation: purl}).latest_per_avid()
 
 
+class PackageCommitPatchFilter(filters.FilterSet):
+    advisory_avid = filters.CharFilter(method="filter_by_advisory", label="Advisory ID")
+    purl = filters.CharFilter(method="filter_by_purl", label="Purl")
+    commit_hash = filters.CharFilter(lookup_expr="exact", label="Commit Hash")
+    vcs_url = filters.CharFilter(lookup_expr="icontains", label="VCS URL")
+
+    class Meta:
+        model = PackageCommitPatch
+        fields = ["advisory_avid", "purl", "commit_hash", "vcs_url"]
+
+    def filter_by_advisory(self, queryset, name, value):
+        return queryset.filter(
+            Q(introduced_in_impacts__advisory__avid=value)
+            | Q(fixed_in_impacts__advisory__avid=value)
+        ).distinct()
+
+    def filter_by_purl(self, queryset, name, value):
+        return queryset.filter(
+            Q(introduced_in_impacts__base_purl__icontains=value)
+            | Q(fixed_in_impacts__base_purl__icontains=value)
+        ).distinct()
+
+
+class PackageCommitPatchViewSet(viewsets.ReadOnlyModelViewSet):
+    """
+    API endpoint that allows viewing PackageCommitPatch entries
+    """
+
+    serializer_class = PackageCommitPatchSerializer
+    throttle_classes = [AnonRateThrottle, PermissionBasedUserRateThrottle]
+    filter_backends = [filters.DjangoFilterBackend]
+    filterset_class = PackageCommitPatchFilter
+
+    def get_queryset(self):
+        return PackageCommitPatch.objects.prefetch_related(
+            "introduced_in_impacts__advisory", "fixed_in_impacts__advisory"
+        ).order_by("id")
+
+
+class PatchFilter(filters.FilterSet):
+    advisory_avid = filters.CharFilter(field_name="advisories__avid", label="Advisory ID")
+
+    class Meta:
+        model = Patch
+        fields = ["advisory_avid"]
+
+
+class PatchViewSet(viewsets.ReadOnlyModelViewSet):
+    """
+    API endpoint that allows viewing Patch entries
+    """
+
+    serializer_class = PatchSerializer
+    throttle_classes = [AnonRateThrottle, PermissionBasedUserRateThrottle]
+    filter_backends = [filters.DjangoFilterBackend]
+    filterset_class = PatchFilter
+
+    def get_queryset(self):
+        return Patch.objects.all()
+
+
 class FixingAdvisoriesViewSet(PackageAdvisoriesViewSet):
     relation = "impacted_packages__fixed_by_packages__package_url"
 
diff --git a/vulnerabilities/tests/test_api_v2.py b/vulnerabilities/tests/test_api_v2.py
index be447ab0b..78b6c1da4 100644
--- a/vulnerabilities/tests/test_api_v2.py
+++ b/vulnerabilities/tests/test_api_v2.py
@@ -23,8 +23,11 @@
 from vulnerabilities.models import Alias
 from vulnerabilities.models import ApiUser
 from vulnerabilities.models import CodeFixV2
+from vulnerabilities.models import ImpactedPackage
 from vulnerabilities.models import Package
+from vulnerabilities.models import PackageCommitPatch
 from vulnerabilities.models import PackageV2
+from vulnerabilities.models import Patch
 from vulnerabilities.models import PipelineRun
 from vulnerabilities.models import PipelineSchedule
 from vulnerabilities.models import Vulnerability
@@ -834,3 +837,142 @@ def test_filter_codefix_by_advisory_id_not_found(self):
             response = self.client.get(self.url, {"advisory_id": "nonexistent/ADVISORY-ID"})
         assert response.status_code == status.HTTP_200_OK
         assert response.data["count"] == 0
+
+
+class PackageCommitPatchList(APITestCase):
+    def setUp(self):
+        self.advisory = AdvisoryV2.objects.create(
+            datasource_id="test_source",
+            advisory_id="TEST-2025-001",
+            avid="test_source/TEST-2025-001",
+            unique_content_id="a" * 64,
+            url="https://example.com/advisory",
+            date_collected="2025-07-01T00:00:00Z",
+        )
+
+        self.affected_package = PackageV2.objects.from_purl(purl="pkg:github/torvalds/linux@1.0.0")
+        self.fixed_package = PackageV2.objects.from_purl(purl="pkg:github/torvalds/linux@1.0.1")
+
+        self.pkg_commit_patch1 = PackageCommitPatch.objects.create(
+            commit_hash="2e1c42391ff2556387b3cb6308b24f6f65619feb",
+            vcs_url="https://github.com/torvalds/linux",
+            patch_text="From 2e1c42391ff2556387b3cb6308b24f6f65619feb Mon Sep 17 00:00:00 2001...",
+        )
+
+        self.pkg_commit_patch2 = PackageCommitPatch.objects.create(
+            commit_hash="99253eb750fda6a644d5188fb26c43bad8d5a745",
+            vcs_url="https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
+            patch_text="From 99253eb750fda6a644d5188fb26c43bad8d5a745 Mon Sep 17 00:00:00 2001...",
+        )
+
+        self.pkg_commit_patch3 = PackageCommitPatch.objects.create(
+            commit_hash="f043bfc98c193c284e2cd768fefabe18ac2fed9b",
+            vcs_url="https://github.com/torvalds/linux",
+            patch_text="From f043bfc98c193c284e2cd768fefabe18ac2fed9b Mon Sep 17 00:00:00 2001...",
+        )
+
+        self.impacted_package1 = ImpactedPackage.objects.create(
+            base_purl="pkg:github/torvalds/linux",
+            advisory=self.advisory,
+        )
+
+        self.impacted_package2 = ImpactedPackage.objects.create(
+            base_purl="pkg:generic/git.kernel.org/pub/scm/linux/kernel",
+            advisory=self.advisory,
+        )
+
+        self.impacted_package1.fixed_by_package_commit_patches.add(self.pkg_commit_patch1)
+        self.impacted_package1.introduced_by_package_commit_patches.add(self.pkg_commit_patch3)
+        self.impacted_package2.fixed_by_package_commit_patches.add(self.pkg_commit_patch2)
+
+        self.user = ApiUser.objects.create_api_user(username="e@mail.com")
+        self.auth = f"Token {self.user.auth_token.key}"
+        self.client = APIClient(enforce_csrf_checks=True)
+        self.client.credentials(HTTP_AUTHORIZATION=self.auth)
+        self.url = reverse("package-commit-patch-list")
+
+    def test_package_commit_patches_list(self):
+        response = self.client.get(self.url)
+        assert response.status_code == 200
+        results = response.json().get("results", response.json())
+        assert len(results) == 3
+        patch_data = results[0]
+        assert patch_data["vcs_url"] == self.pkg_commit_patch1.vcs_url
+        assert patch_data["commit_hash"] == self.pkg_commit_patch1.commit_hash
+        assert patch_data["fixed_in_advisories"] == [
+            {"avid": self.advisory.avid, "purl": self.impacted_package1.base_purl}
+        ]
+        assert patch_data["introduced_in_advisories"] == []
+
+    def test_filter_by_commit_hash(self):
+        response = self.client.get(f"{self.url}?commit_hash={self.pkg_commit_patch1.commit_hash}")
+        results = response.json().get("results", response.json())
+        assert len(results) == 1
+
+        response = self.client.get(f"{self.url}?commit_hash=test")
+        results = response.json().get("results", response.json())
+        assert len(results) == 0
+
+    def test_filter_by_vcs_url(self):
+        response = self.client.get(f"{self.url}?vcs_url={self.pkg_commit_patch1.vcs_url}")
+        results = response.json().get("results", response.json())
+        assert len(results) == 2
+
+        response = self.client.get(f"{self.url}?vcs_url=test")
+        results = response.json().get("results", response.json())
+        assert len(results) == 0
+
+    def test_filter_by_advisory_avid(self):
+        response = self.client.get(f"{self.url}?advisory_avid={self.advisory.avid}")
+        results = response.json().get("results", response.json())
+        assert len(results) == 3
+
+        response = self.client.get(f"{self.url}?advisory_avid=test_source/DOES-NOT-EXIST")
+        results = response.json().get("results", response.json())
+        assert len(results) == 0
+
+    def test_filter_by_purl(self):
+        response = self.client.get(f"{self.url}?purl=pkg:github/torvalds/linux")
+        results = response.json().get("results", response.json())
+        assert len(results) == 2
+
+        response = self.client.get(f"{self.url}?purl=pkg:github/aboutcode-org")
+        results = response.json().get("results", response.json())
+        assert len(results) == 0
+
+
+class PatchList(APITestCase):
+    def setUp(self):
+        self.advisory = AdvisoryV2.objects.create(
+            datasource_id="test_source",
+            advisory_id="TEST-2025-001",
+            avid="test_source/TEST-2025-001",
+            unique_content_id="a" * 64,
+            url="https://example.com/advisory",
+            date_collected="2025-07-01T00:00:00Z",
+        )
+
+        self.patch = Patch.objects.create(
+            patch_url="https://lore.kernel.org/patchwork/patch/1086060/", patch_text="some text"
+        )
+
+        self.advisory.patches.add(self.patch)
+
+        self.user = ApiUser.objects.create_api_user(username="e@mail.com")
+        self.auth = f"Token {self.user.auth_token.key}"
+        self.client = APIClient(enforce_csrf_checks=True)
+        self.client.credentials(HTTP_AUTHORIZATION=self.auth)
+        self.url = reverse("patches-list")
+
+    def test_patch_list(self):
+        response = self.client.get(self.url)
+        assert response.status_code == 200
+        results = response.json().get("results", response.json())
+        assert len(results) == 1
+        assert results[0]["patch_url"] == self.patch.patch_url
+        assert results == [
+            {
+                "patch_url": "https://lore.kernel.org/patchwork/patch/1086060/",
+                "in_advisories": ["test_source/TEST-2025-001"],
+            }
+        ]
diff --git a/vulnerabilities/utils.py b/vulnerabilities/utils.py
index e8a13821e..a5bf24f9f 100644
--- a/vulnerabilities/utils.py
+++ b/vulnerabilities/utils.py
@@ -37,6 +37,7 @@
 from cwe2.database import InvalidCWEError
 from packageurl import PackageURL
 from packageurl.contrib.django.utils import without_empty_values
+from packageurl.contrib.url2purl import url2purl
 from univers.version_range import RANGE_CLASS_BY_SCHEMES
 from univers.version_range import AlpineLinuxVersionRange
 from univers.version_range import NginxVersionRange
@@ -1033,3 +1034,51 @@ def merge_and_save_grouped_advisories(package, advisories, relation):
     "gem",
     "conan",
 ]
+
+
+def generate_commit_url(vcs_url, commit_hash):
+    """
+    Generate commit URL from VCS URL and commit hash.
+    """
+    from packageurl.contrib import purl2url
+
+    if not vcs_url or not commit_hash:
+        return
+
+    purl = url2purl(vcs_url)
+    if not purl:
+        return
+
+    new_purl = PackageURL(
+        type=purl.type,
+        namespace=purl.namespace,
+        name=purl.name,
+        version=commit_hash,
+        qualifiers=purl.qualifiers,
+    )
+
+    return purl2url.get_commit_url(str(new_purl))
+
+
+def generate_patch_url(vcs_url, commit_hash):
+    """
+    Generate patch URL from VCS URL and commit hash.
+    """
+    from packageurl.contrib import purl2url
+
+    if not vcs_url or not commit_hash:
+        return
+
+    purl = url2purl(vcs_url)
+    if not purl:
+        return
+
+    new_purl = PackageURL(
+        type=purl.type,
+        namespace=purl.namespace,
+        name=purl.name,
+        version=commit_hash,
+        qualifiers=purl.qualifiers,
+    )
+
+    return purl2url.get_patch_url(str(new_purl))
diff --git a/vulnerabilities/views.py b/vulnerabilities/views.py
index 371dcd217..af257db90 100644
--- a/vulnerabilities/views.py
+++ b/vulnerabilities/views.py
@@ -753,6 +753,7 @@ def add_ssvc(ssvc):
                 "advisory": advisory,
                 "severities": list(advisory.severities.all()),
                 "references": list(advisory.references.all()),
+                "patches": list(advisory.patches.all()),
                 "aliases": list(advisory.aliases.all()),
                 "severity_vectors": severity_vectors,
                 "weaknesses": weaknesses_present_in_db,
@@ -948,6 +949,57 @@ def get_queryset(self):
         )
 
 
+class AdvisoryPackageCommitPatchDetails(DetailView):
+    """
+    View to display all packages introduce by or fixing a specific vulnerability.
+    URL: /advisories/{id}/commits
+    """
+
+    model = models.AdvisoryV2
+    template_name = "advisory_package_commit_details.html"
+    slug_url_kwarg = "avid"
+
+    def get_object(self, queryset=None):
+        avid = self.kwargs.get(self.slug_url_kwarg)
+        if not avid:
+            raise Http404("Missing advisory identifier")
+
+        advisory = models.AdvisoryV2.objects.latest_for_avid(avid)
+
+        if not advisory:
+            raise Http404(f"No advisory found for avid: {avid}")
+
+        return advisory
+
+    def get_queryset(self):
+        """
+        Prefetch and optimize related data to minimize database hits.
+        """
+        return (
+            super()
+            .get_queryset()
+            .prefetch_related(
+                Prefetch(
+                    "impacted_packages",
+                    queryset=models.ImpactedPackage.objects.order_by("base_purl").prefetch_related(
+                        Prefetch(
+                            "introduced_by_package_commit_patches",
+                            queryset=models.PackageCommitPatch.objects.only(
+                                "commit_hash", "vcs_url", "patch_url", "commit_url"
+                            ),
+                        ),
+                        Prefetch(
+                            "fixed_by_package_commit_patches",
+                            queryset=models.PackageCommitPatch.objects.only(
+                                "commit_hash", "vcs_url", "patch_url", "commit_url"
+                            ),
+                        ),
+                    ),
+                )
+            )
+        )
+
+
 class PipelineScheduleListView(VulnerableCodeListView, FormMixin):
     model = PipelineSchedule
     context_object_name = "schedule_list"
diff --git a/vulnerablecode/urls.py b/vulnerablecode/urls.py
index e9d56f75d..92d074631 100644
--- a/vulnerablecode/urls.py
+++ b/vulnerablecode/urls.py
@@ -28,7 +28,9 @@
 from vulnerabilities.api_v3 import AdvisoryV3ViewSet
 from vulnerabilities.api_v3 import AffectedByAdvisoriesViewSet
 from vulnerabilities.api_v3 import FixingAdvisoriesViewSet
+from vulnerabilities.api_v3 import PackageCommitPatchViewSet
 from vulnerabilities.api_v3 import PackageV3ViewSet
+from vulnerabilities.api_v3 import PatchViewSet
 from vulnerabilities.views import AdminLoginView
 from vulnerabilities.views import AdvisoryDetails
 from vulnerabilities.views import AdvisoryPackageCommitPatchDetails
@@ -82,6 +84,11 @@ def __init__(self, *args, **kwargs):
 )
 api_v3_router.register("fixing-advisories", FixingAdvisoriesViewSet, basename="fixing-advisories")
 
+api_v3_router.register(
+    "package-commit-patches", PackageCommitPatchViewSet, basename="package-commit-patch"
+)
+api_v3_router.register("patches", PatchViewSet, basename="patches")
+
 urlpatterns = [
     path("admin/login/", AdminLoginView.as_view(), name="admin-login"),
     path("api/v2/", include(api_v2_router.urls)),