GitHub Security Advisories — Affected Packages and Severity

GitHub's reviewed security advisories as flat rows — GHSA and CVE ids, summary, severity, affected package and ecosystem, vulnerable range and patched version. Free public API.

What you get

cveId, summary, severity, type, ecosystem, package, vulnerableRange, patchedVersion, publishedAt, updatedAt, url, id.

Sample output

[
  {
    "cveId": "CVE-2026-114191",
    "summary": "Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi...",
    "severity": "high",
    "publishedAt": "2026-10-24T15:32:53Z",
    "updatedAt": "2026-10-24T15:32:59Z",
    "url": "https://github.com/advisories/GHSA-j9wp-962q-w884"
  },
  {
    "cveId": "CVE-2026-114704",
    "summary": "Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi...",
    "severity": "high",
    "publishedAt": "2026-10-24T15:32:53Z",
    "updatedAt": "2026-10-24T15:32:58Z",
    "url": "https://github.com/advisories/GHSA-q53w-3673-wrjv"
  }
]

Limitations

• Only the FIRST affected package is mapped. An advisory touching several packages or ecosystems returns one row; the rest are in the API response but not in the row.
• ghsa_id is GitHub's own identifier, and cve_id may be null for an advisory GitHub reviewed before a CVE was assigned.
• severity here is GitHub's rating, which can differ from the NVD's for the same CVE.
• patchedVersion is null when no fix exists — which is a real state, not missing data.
• The unauthenticated GitHub API allows 60 requests an hour, so this Actor paces itself; a token would raise that.

Pricing

Pay per result.

Fields

Field	Type	What it holds
cveId	string	The CVE identifier this advisory maps to, where one was assigned.
summary	string	Short human-readable summary of this row.
severity	string	Severity as classified by the source.
ecosystem	string	Package ecosystem, for example npm, PyPI or Maven.
package	string	Package name.
vulnerableRange	string	Version range affected by this issue.
patchedVersion	string	First version of the package that fixed the issue. Absent when no fix has shipped.
publishedAt	string	ISO 8601 timestamp of publication.
updatedAt	string	ISO 8601 timestamp of the most recent upstream update.
url	string	The URL this row describes.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• GitHub Security Advisories — Affected Packages and Severity declares all 10 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of GitHub Security Advisories include cveId, summary, severity, ecosystem, package and vulnerableRange.
• GitHub Security Advisories needs no API key, login or account of any kind before its first run.
• Every one of GitHub Security Advisories's 5 inputs is optional, so it runs with no configuration at all.
• GitHub Security Advisories documents cveId as: The CVE identifier this advisory maps to, where one was assigned.
• Every number published about GitHub Security Advisories is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• GitHub Security Advisories is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

FAQ

What does GitHub Security Advisories return?

It returns 10 documented output fields — cveId, summary, severity, ecosystem, package, vulnerableRange, patchedVersion and publishedAt — each with a declared type and a written description. The full schema is below.

What does GitHub Security Advisories require to run?

Nothing. All 5 inputs are optional and ship with working defaults.

Does GitHub Security Advisories need an API key?

No. It reads only public data and asks for no account.

How is GitHub Security Advisories billed?

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.