diff --git a/pyoaev/apis/__init__.py b/pyoaev/apis/__init__.py
index ba25cc4..b21ef4a 100644
--- a/pyoaev/apis/__init__.py
+++ b/pyoaev/apis/__init__.py
@@ -17,5 +17,6 @@
 from .tag import *  # noqa: F401,F403
 from .team import *  # noqa: F401,F403
 from .user import *  # noqa: F401,F403
+from .vulnerability import *  # noqa: F401,F403
 
 __all__ = [name for name in dir() if not name.startswith("_")]
diff --git a/pyoaev/apis/vulnerability.py b/pyoaev/apis/vulnerability.py
new file mode 100644
index 0000000..5418afc
--- /dev/null
+++ b/pyoaev/apis/vulnerability.py
@@ -0,0 +1,18 @@
+from typing import Any, Dict
+
+from pyoaev import exceptions as exc
+from pyoaev.base import RESTManager, RESTObject
+
+
+class Vulnerability(RESTObject):
+    _id_attr = "vulnerability_id"
+
+
+class VulnerabilityManager(RESTManager):
+    _path = "/vulnerabilities"
+
+    @exc.on_http_error(exc.OpenAEVUpdateError)
+    def upsert(self, data: Dict[str, Any], **kwargs: Any) -> Dict[str, Any]:
+        path = f"{self.path}/bulk"
+        result = self.openaev.http_post(path, post_data=data, **kwargs)
+        return result