GitHub Security Advisories and CVE Vulnerability Radar

Track open-source security advisories, CVE identifiers, CVSS severity metrics, affected package managers, and remediation versions across software ecosystems.

Features

• Filters advisories by package ecosystem including npm, pip, Maven, Go, Cargo, NuGet, RubyGems, and Packagist.
• Provides CVSS v3 severity scores, vulnerability vectors, and qualitative ratings from low to critical.
• Captures affected version ranges alongside confirmed patched release versions for automated remediation.
• Connects GitHub Advisory IDs (GHSA) to standard national vulnerability database CVE identifiers.
• Operates via public GitHub API endpoints without requiring personal access tokens or proxy servers.

Input parameters

• Package Ecosystem: Filter by specific package ecosystem (for example: npm, pip, maven, cargo) or select all ecosystems. Default is all.
• Minimum Severity: Filter records by critical, high, medium, or low severity ratings. Default is all.
• Maximum Advisories: Number of recent security advisories to collect. Default is 50, maximum is 200.

Output dataset fields

Each dataset record contains:

• ghsaId: Official GitHub Security Advisory identifier (for example: GHSA-jqc4-5cvw-7w85).
• cveId: Common Vulnerabilities and Exposures code (for example: CVE-2026-112937).
• summary: Human-readable technical summary of the flaw.
• severity: Vulnerability rating such as low, medium, high, or critical.
• cvssScore: Quantitative CVSS score between 0.0 and 10.0.
• cvssVectorString: Complete CVSS vector metrics string.
• ecosystem: Affected language packaging registry (npm, pip, maven, go).
• packageName: Name of the vulnerable package or library.
• vulnerableVersionRange: Version boundary specification impacted by the flaw.
• firstPatchedVersion: Safe release containing the security fix.
• publishedAt: Timestamp when the advisory was publicly disclosed.
• updatedAt: Timestamp of the most recent advisory revision.
• advisoryUrl: Direct URL to the advisory on GitHub.
• scrapedAt: UTC timestamp when the record was extracted.

Use cases

• Software supply chain security: Monitor third-party open-source dependencies for newly published exploits.
• DevSecOps pipelines: Trigger automated dependency upgrade workflows when patches are released.
• Vulnerability research: Track disclosure rates and severity distributions across major developer ecosystems.
• Compliance reporting: Generate vulnerability scan histories for security certifications.