GitHub Security Advisories Scraper — GHSA & CVE

Scrape the GitHub Advisory Database (GHSA) — security advisories mapped to CVEs, affected packages, version ranges, CVSS and CWE. Filter by ecosystem (npm, pip, maven...) and severity. Official keyless API. Schedule as a dependency-vulnerability monitor. Pay per result.

Input

The actor accepts the following input properties from its input schema:

• ecosystem ("string"): Filter by package ecosystem: npm, pip, composer, maven, nuget, go, rubygems, rust, pub, swift, erlang, actions, nuget, other. Leave blank for all.
• severity ("string"): Filter by severity: low, medium, high, critical. Leave blank for all.
• cwes ("string"): Filter by CWE, comma-separated (e.g. 79,89). Leave blank for all.
• advisoryType ("string"): reviewed (GitHub-reviewed, mapped to CVE), unreviewed, or malware.
• sort ("string"): Order advisories by published or updated date (newest first).
• githubToken ("string"): Optional free GitHub personal access token to raise the rate limit. Never required.
• maxItems ("integer"): Maximum number of advisories to return.
• proxyConfiguration ("object"): Apify proxy used to reach the API. Residential is the reliable default; the run is billed to your account.

These names, types, and descriptions are taken directly from the declared input schema.

Output

Runs produce structured JSON records in the run dataset, downloadable via the Apify API or console.

Usage

Run the actor from the Apify console or via the API.

What you get

Every record is one GitHub-reviewed (or unreviewed / malware) security advisory from the official GitHub Advisory Database. The actor reads the keyless public API (api.github.com/advisories) and follows its cursor pagination, so a large maxItems simply means more pages. Each record is flattened: the first affected package is promoted to top-level fields (ecosystem, package_name, vulnerable_version_range, first_patched_version), and every affected package is also listed in affected_packages as ecosystem:name pairs separated by semicolons. CVSS score and vector, CWE ids, publication and update timestamps and the advisory URL are included, and the description is truncated to 2000 characters.

Typical uses:

• A dependency-vulnerability monitor: schedule the actor daily with sort = updated and severity = high, then diff the dataset against your last run.
• An SBOM or lockfile audit: filter by ecosystem (npm, pip, maven, ...) and match package_name and vulnerable_version_range against your own inventory.
• Security research and reporting: filter by cwes (for example 79,89) to study one weakness class across ecosystems.

Output example

{
  "ghsa_id": "GHSA-xxxx-xxxx-xxxx",
  "cve_id": "CVE-2026-0000",
  "summary": "Prototype pollution in example-package",
  "severity": "high",
  "cvss_score": 7.5,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "ecosystem": "npm",
  "package_name": "example-package",
  "vulnerable_version_range": "< 1.2.3",
  "first_patched_version": "1.2.3",
  "affected_packages": "npm:example-package",
  "cwe_ids": "CWE-1321",
  "advisory_type": "reviewed",
  "published_at": "2026-09-30T12:00:00Z",
  "updated_at": "2026-10-01T08:30:00Z",
  "github_reviewed_at": "2026-09-30T15:00:00Z",
  "source_code_location": "https://github.com/example/example-package",
  "html_url": "https://github.com/advisories/GHSA-xxxx-xxxx-xxxx",
  "description": "Versions of example-package before 1.2.3 allow an attacker to modify Object.prototype ..."
}

Run status and partial results

The run status message always says what happened. If the GitHub API rate-limits or fails on a later page, the advisories already fetched are still saved and charged, and the message tells you how many were delivered, which page failed and what to change (add a free githubToken, use the RESIDENTIAL proxy, or re-run later). If nothing matches your filters, the run ends with an explained empty status and you are not charged for zero results.

Pricing

Pay per result: one advisory event is charged for each record saved to the dataset.

If this actor saved you time, a short rating in the Store helps a lot.