Pricing

Pay per usage

GitHub Security Advisory Tracker — New GHSA Advisories

Track new GitHub Security Advisories (GHSA) by package ecosystem, package name, or severity. Get affected version ranges, patched versions, CVSS score, and CWE for open-source dependency vulnerabilities.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Timothy Kelvin

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

Input

{
  "ecosystem": "npm",
  "packageName": "lodash",
  "severity": "all",
  "daysBack": 30,
  "maxResults": 25
}

Field	Type	Description
`ecosystem`	string	`"all"` or one of `npm`, `pip`, `maven`, `nuget`, `composer`, `rubygems`, `go`, `rust`, `actions`, `pub`, `swift`, `erlang`. Default `"all"`.
`packageName`	string (optional)	Limit to advisories affecting this specific package.
`severity`	string	`"all"`, `"low"`, `"medium"`, `"high"`, or `"critical"` — exact match, not a threshold. Default `"all"`.
`daysBack`	number	How many days back from today to search, by publish date. Default `30`, max `365`.
`maxResults`	number	Max advisories to return, most recently published first. Default `25`, max `100`.

Output

One record per advisory:

{
  "ghsaId": "GHSA-r5fr-rjxr-66jc",
  "cveId": "CVE-2026-XXXXX",
  "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
  "severity": "high",
  "cvssScore": 8.4,
  "cweIds": ["CWE-94"],
  "affectedPackages": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "vulnerableVersionRange": "< 4.17.21",
      "firstPatchedVersion": "4.17.21"
    }
  ],
  "publishedAt": "2026-08-07T18:48:59Z",
  "updatedAt": "2026-08-07T18:48:59Z",
  "htmlUrl": "https://github.com/advisories/GHSA-r5fr-rjxr-66jc"
}

summary is a one-line description; open htmlUrl for the full write-up (PoC, remediation detail), which isn't included here since advisory bodies can run to thousands of words.

A search with no matching advisories returns no items but is still billed once for the search.

How it works

Direct calls to the official GitHub Security Advisories REST API (api.github.com/advisories) — no proxy, no key, no scraping.

Pricing note

Billed per search, not per advisory returned — one charge whether the search returns 0 advisories or 100.

NPM Package Update Tracker — new versions/deprecations for a package you depend on
Vulnerability Alert — the broader NVD/CVE database, not scoped to a package ecosystem

Dependency Audit — CVE, License & EOL Check for AI

haketa/dependency-audit

Audit any software dependency for vulnerabilities (CVE), license, deprecation, end-of-life and health scores in one call. Supports npm, PyPI, crates, Go, Maven, NuGet, RubyGems. Supply-chain security grounding for AI coding agents & SCA.

Haketa

CVE Security Advisory Monitor — AI Agent Vulnerability API

logiover/cve-security-advisory-monitor

Keyless vulnerability intelligence for AI agents: NVD + GitHub Security Advisories + OSV merged. Daily new CVEs, keyword search, or product/package lookups. CVSS scores, weaknesses, affected versions, patch info and references per row. No API key, no browser.

Logiover

GitHub Security Advisories Scraper

parseforge/github-security-advisories-ghsa-scraper

Scrapes GitHub Security Advisories (GHSA) by ecosystem, severity, CVE ID, or affected package. Returns each advisory as a flat row with CVE, CVSS, EPSS, and package details.

ParseForge

GitHub Security Advisories Scraper

parseforge/github-security-advisories-scraper

Scrapes GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, CWE, or date range. Returns each advisory as a flat row with description, affected packages, CVSS scores, and references. Export to CSV, JSON, Excel, or XML.

ParseForge

Developer Signal Monitor

silicon1235/developer-signal-monitor

Monitor public npm packages, maintainers, package license changes, GitHub releases, OSV/SBOM advisories, and Docker tags for developer signals.

X L

GitHub Advisories Scraper: GHSA Security Database

arman-bd/github-advisories-scraper

Scrape the GitHub Advisory Database: GHSA identifiers, CVE aliases, severity, affected package ranges, patched versions and CWEs. Curated and often ahead of NVD.

Arman Hossain

🐛 CVE & Advisory Monitor - Alerts For Your Tech Stack

that_red_bird/cve-monitor

⚡ Get alerted when a new vulnerability hits software you actually run. ✅ NIST NVD plus GitHub Security Advisories, filtered by product, package, ecosystem and severity. ✅ Each CVE and GHSA is announced exactly once. No API key required.

mohamed alaya

Open Source Dependency Vulnerability Scanner

scrapemint/dependency-vulnerability-scanner

Scan dependencies against the OSV.dev database. Supply packages as ecosystem:name@version (npm, PyPI, Go, Maven, crates.io and more); get one row per known vulnerability with OSV/GHSA id, CVE aliases, severity, affected range, and the fix version. Dedupe mode gives a new-vulnerability feed.