A distributed vulnerability database for Open Source
An open, precise, and distributed approach to producing and consuming vulnerability information for open source.
Ecosystems
- AlmaLinux
- 6204 View AlmaLinux vulnerabilities
- Alpaquita
- 17072 View Alpaquita vulnerabilities
- Alpine
- 4721 View Alpine vulnerabilities
- Android
- 3701 View Android vulnerabilities
- Azure Linux
- 19442 View Azure Linux vulnerabilities
- BellSoft Hardened Containers
- 861 View BellSoft Hardened Containers vulnerabilities
- Bitnami
- 9878 View Bitnami vulnerabilities
- Chainguard
- 1255194 View Chainguard vulnerabilities
- CleanStart
- 7988 View CleanStart vulnerabilities
- crates.io
- 2845 View crates.io vulnerabilities
- Debian
- 71731 View Debian vulnerabilities
- Echo
- 9181 View Echo vulnerabilities
- GIT
- 115371 View GIT vulnerabilities
- GitHub Actions
- 55 View GitHub Actions vulnerabilities
- Go
- 9598 View Go vulnerabilities
- Hackage
- 33 View Hackage vulnerabilities
- Hex
- 384 View Hex vulnerabilities
- Julia
- 1713 View Julia vulnerabilities
- Linux
- 30899 View Linux vulnerabilities
- Mageia
- 6308 View Mageia vulnerabilities
- Maven
- 7086 View Maven vulnerabilities
- MinimOS
- 182641 View MinimOS vulnerabilities
- npm
- 229998 View npm vulnerabilities
- NuGet
- 1924 View NuGet vulnerabilities
- opam
- 35 View opam vulnerabilities
- openEuler
- 9199 View openEuler vulnerabilities
- openSUSE
- 14918 View openSUSE vulnerabilities
- OSS-Fuzz
- 4034 View OSS-Fuzz vulnerabilities
- Packagist
- 7185 View Packagist vulnerabilities
- PyPI
- 25992 View PyPI vulnerabilities
- Red Hat
- 23995 View Red Hat vulnerabilities
- Rocky Linux
- 4558 View Rocky Linux vulnerabilities
- Root
- 19726 View Root vulnerabilities
- RubyGems
- 5397 View RubyGems vulnerabilities
- SUSE
- 23921 View SUSE vulnerabilities
- SwiftURL
- 61 View SwiftURL vulnerabilities
- TuxCare
- 17730 View TuxCare vulnerabilities
- Ubuntu
- 68325 View Ubuntu vulnerabilities
- Wolfi
- 332081 View Wolfi vulnerabilities
OSV schema
All advisories in this database use the OpenSSF OSV format, which was developed in collaboration with open source communities.
The OSV schema provides a human and machine readable data format to describe vulnerabilities in a way that precisely maps to open source package versions or commit hashes.
{
"schema_version": "1.7.4",
"id": "GHSA-c3g4-w6cv-6v7h",
"modified": "2022-04-01T13:56:42Z",
"published": "2022-04-01T13:56:42Z",
"aliases": [ "CVE-2022-27651" ],
"summary": "Non-empty default inheritable capabilities for linux container in Buildah",
"details": "A bug was found in Buildah where containers were created ...",
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/buildah"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/containers/buildah/commit/..."
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/buildah"
}
]
}Data sources
This infrastructure serves as an aggregator of vulnerability databases that have adopted the OSV schema, including GitHub Security Advisories, PyPA, RustSec, and Global Security Database, and more.
Use the API
An easy-to-use API is available to query for all known vulnerabilities by either a commit hash, or a package version.
Query by commit hash
curl -d \
'{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}' \
"https://api.osv.dev/v1/query"
Query by version number
curl -d \
'{"version": "2.4.1",
"package": {"name": "jinja2", "ecosystem": "PyPI"}}' \
"https://api.osv.dev/v1/query"
Vulnerability Scanner
Install OSV‑Scanner
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2
Scan SBOM or Lockfiles
osv-scanner --sbom=cycloned-or-spdx-sbom.json
osv-scanner --lockfile=package-lock.json
Scan directory recursively
osv-scanner -r path/to/your/project
Remediation Tools
Guided Remediation (basic)
osv-scanner fix --non-interactive --strategy=in-place -L path/to/package-lock.json
osv-scanner fix --non-interactive --strategy=relock -M path/to/package.json -L path/to/package-lock.json
Guided Remediation (interactive)
osv-scanner fix -M path/to/package.json -L path/to/package-lock.json
Container Image Scanning
You can use OSV-Scanner to scan your container images for known vulnerabilities.
Scan container image
osv-scanner scan image --serve alpine:3.12
GitHub Workflows
OSV-Scanner also provides reusable GitHub workflows that can be easily integrated into CI/CD pipelines to provide continuous vulnerability scanning coverage. This can scan newly added dependencies in pull requests for introduced vulnerabilities, as well as perform regular vulnerability scans for the entire project.
