Return a paginated, customer-centric view of CVE exposure. Customers are
first selected when an instance's latest reported downstream release has
a matching release-image CVE posture. All instances for selected customers
are then returned with per-instance CVE counts sourced from SDK-reported
running images or uploaded support bundles. Each customer's top-level CVE
counts come from its selected worst instance (null when no instance has
data), preserving a real instance's posture instead of synthesizing counts
across mixed releases. Reporting instances also include the resolved and
introduced CVE counts for upgrading supported Helm and Embedded Cluster
instances to the latest release currently available on their reported
channel when both releases have complete scan data. Each customer includes
the recommendation with the highest-severity reduction. Airgap instances
without SDK reporting are returned only when another instance selects their
customer; they carry the license channel's latest-release CVE posture as
context.
The severity filter accepts a set (repeatable and/or comma-separated) and
keeps customers whose selected worst instance has at least one CVE in any
selected severity; customers without CVE data are excluded while a severity
filter is active. Counts
in the response always cover all four severities. With
includeSnapshot=true, both the customer page and an unfiltered snapshot are
derived from the authorized fleet's hydrated runtime rows. The snapshot
reports the total authorized app-customer population, the number impacted
by critical or high CVEs, and active instances with critical CVEs by
reported channel release without a second customer-impact request. Requires
the Security Center team feature; teams without it receive 403.

Required RBAC Policy: kots/app/[:appid]/license/[:licenseid]/read