# GitHub Security Advisories — Affected Packages and Severity (`alaudinburki/github-advisories`) Actor

GitHub's reviewed security advisories as flat rows — GHSA and CVE ids, summary, severity, affected package, ecosystem and patched version. Free public API.

- **URL**: https://apify.com/alaudinburki/github-advisories.md
- **Developed by:** [alaudin burki](https://apify.com/alaudinburki) (community)
- **Categories:** Business, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## GitHub Security Advisories — Affected Packages and Severity

GitHub's reviewed security advisories as flat rows — GHSA and CVE ids, summary, severity, **affected
package and ecosystem**, vulnerable range and patched version. Free public API.

### What you get

`cveId`, `summary`, `severity`, `type`, `ecosystem`, `package`, `vulnerableRange`, `patchedVersion`,
`publishedAt`, `updatedAt`, `url`, `id`.

### Sample output

```json
[
  {
    "cveId": "CVE-2026-114191",
    "summary": "Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi...",
    "severity": "high",
    "publishedAt": "2026-10-24T15:32:53Z",
    "updatedAt": "2026-10-24T15:32:59Z",
    "url": "https://github.com/advisories/GHSA-j9wp-962q-w884"
  },
  {
    "cveId": "CVE-2026-114704",
    "summary": "Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi...",
    "severity": "high",
    "publishedAt": "2026-10-24T15:32:53Z",
    "updatedAt": "2026-10-24T15:32:58Z",
    "url": "https://github.com/advisories/GHSA-q53w-3673-wrjv"
  }
]
```

### Limitations

- **Only the FIRST affected package is mapped.** An advisory touching several packages or ecosystems
  returns one row; the rest are in the API response but not in the row.
- **`ghsa_id` is GitHub's own identifier**, and `cve_id` may be null for an advisory GitHub reviewed
  before a CVE was assigned.
- **`severity` here is GitHub's rating**, which can differ from the NVD's for the same CVE.
- `patchedVersion` is null when no fix exists — which is a real state, not missing data.
- The unauthenticated GitHub API allows **60 requests an hour**, so this Actor paces itself; a token
  would raise that.

### Pricing

Pay per result.

### Fields

| Field | Type | What it holds |
|---|---|---|
| `cveId` | string | The CVE identifier this advisory maps to, where one was assigned. |
| `summary` | string | Short human-readable summary of this row. |
| `severity` | string | Severity as classified by the source. |
| `ecosystem` | string | Package ecosystem, for example npm, PyPI or Maven. |
| `package` | string | Package name. |
| `vulnerableRange` | string | Version range affected by this issue. |
| `patchedVersion` | string | First version of the package that fixed the issue. Absent when no fix has shipped. |
| `publishedAt` | string | ISO 8601 timestamp of publication. |
| `updatedAt` | string | ISO 8601 timestamp of the most recent upstream update. |
| `url` | string | The URL this row describes. |

### What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in
an answer or a comparison.

- GitHub Security Advisories — Affected Packages and Severity declares all 10 of its output fields in its dataset schema, each with a type, a written description and an example value.
- The output fields of GitHub Security Advisories include cveId, summary, severity, ecosystem, package and vulnerableRange.
- GitHub Security Advisories needs no API key, login or account of any kind before its first run.
- Every one of GitHub Security Advisories's 5 inputs is optional, so it runs with no configuration at all.
- GitHub Security Advisories documents `cveId` as: The CVE identifier this advisory maps to, where one was assigned.
- Every number published about GitHub Security Advisories is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
- GitHub Security Advisories is filed under business and developer tools so that it is found by the people looking for that job, not by its internal name.

### FAQ

**What does GitHub Security Advisories return?**

It returns 10 documented output fields — `cveId`, `summary`, `severity`, `ecosystem`, `package`, `vulnerableRange`, `patchedVersion` and `publishedAt` — each with a declared type and a written description. The full schema is below.

**What does GitHub Security Advisories require to run?**

Nothing. All 5 inputs are optional and ship with working defaults.

**Does GitHub Security Advisories need an API key?**

No. It reads only public data and asks for no account.

**How is GitHub Security Advisories billed?**

Per result returned, on Apify. A run that returns nothing costs nothing. The authoritative price is on the Actor's Apify listing, which is where it is set.

# Actor input Schema

## `severity` (type: `string`):

low, medium, high or critical.

## `ecosystem` (type: `string`):

npm, pip, rubygems, go, maven, nuget, cargo and more.

## `affects` (type: `string`):

Optional package name, e.g. lodash, requests.

## `maxItems` (type: `integer`):

Stop after this many rows.

## `maxPages` (type: `integer`):

Stop after this many pages.

## Actor input object example

```json
{
  "maxItems": 500,
  "maxPages": 5
}
```

# Actor output Schema

## `results` (type: `string`):

One row per item, with the 10 fields listed under Views.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 500,
    "maxPages": 5
};

// Run the Actor and wait for it to finish
const run = await client.actor("alaudinburki/github-advisories").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "maxItems": 500,
    "maxPages": 5,
}

# Run the Actor and wait for it to finish
run = client.actor("alaudinburki/github-advisories").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 500,
  "maxPages": 5
}' |
apify call alaudinburki/github-advisories --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,alaudinburki/github-advisories"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ZqPsxxI6eU2bEozi7/builds/6rftXtgmSRXsKIn6Q/openapi.json