OSV Advisory Lookup: Security Advisories by Package or ID
Pricing
from $0.10 / 1,000 advisories
OSV Advisory Lookup: Security Advisories by Package or ID
Look up open-source security advisories from OSV.dev by package (npm, PyPI, Go, Maven, crates.io and more) or by advisory ID. Advisory data and links only, with each source's license.
Pricing
from $0.10 / 1,000 advisories
Rating
0.0
(0)
Developer
Lepi Data
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 hours ago
Last modified
Categories
Share
What it does. Look up published open-source security advisories from OSV.dev for a list of packages (optionally a specific version) or advisory IDs. Returns one row per advisory with affected packages, fixed versions, severity, links and the source database's license. Useful for dependency reviews, SBOM enrichment and upgrade planning.
Input (from .actor/input_schema.json)
packages:ecosystem:nameorecosystem:name@version(npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Hex, Pub, ...)advisoryIds: e.g.CVE-2021-44228,GHSA-...,PYSEC-...maxItems: up to 5,000 rows
Output fields
id, aliases, query, summary, severity, severityLabel, cwes, published, modified, withdrawn, packages, introducedVersions, fixedVersions, references, osvUrl, sourceDatabase, sourceLicense, sourceLicenseUrl, sourceUrl, dataSourcesUrl
Free status rows (not charged): no-results (also per package/ID with nothing listed), invalid-input, api-error, free-plan-limit, charge-limit-reached.
Example (the build's prefill)
Input: {"packages":["npm:lodash@4.17.20","PyPI:django@3.2.0"],"advisoryIds":["CVE-2021-44228"],"maxItems":200}
Data source and compliance
- Source: OSV.dev (Open Source Vulnerabilities), via the public api.osv.dev API. OSV aggregates many databases and each entry keeps its own license: every row carries
sourceDatabase,sourceLicenseandsourceLicenseUrlfrom OSV's data-sources list (https://google.github.io/osv.dev/data/). Where that list names no license, the field is empty and you should check the source. Credit the source database when you reuse an entry. This is an independent Lepi Data tool, not affiliated with or endorsed by Google or OSV.dev. - Advisory data and links only. The long free-text
detailsfield is not returned, and evidence/exploit/proof-of-concept links are removed. No exploit code is ever returned. - Paced requests with back-off on errors.
- Free-plan accounts get up to 100 results per run.
Pricing. Pay per result, flat on every plan, no start fee. Free status rows are never charged.
