GitHub Security Advisories Scraper

🔎 GitHub Security Advisories scraper for GHSA and CVE exports

GitHub Security Advisories Scraper collects public GitHub Security Advisory records and saves one clean dataset row per advisory. Use it for AppSec, DevSecOps, SBOM enrichment, vulnerability monitoring, dashboards, and scheduled advisory exports with source-backed GHSA, CVE, severity, CVSS, EPSS, CWE, affected package, fixed version, reference, credit, and timestamp data.

• Run a GitHub Security Advisories scraper to export recent public advisory records for vulnerability review.
• Use GitHub advisory CVE lookup when you need normalized rows for known CVE identifiers.
• Use GHSA advisory lookup to collect exact GitHub Security Advisory records for automation.
• Build a GitHub vulnerability feed for scheduled monitoring of newly published or updated advisories.
• Create package vulnerability exports for affected ecosystems, packages, vulnerable ranges, and patched versions.
• Prepare SBOM vulnerability enrichment data with CWE, CVSS, EPSS, references, and affected package details.
• Download GitHub Security Advisories data from Apify datasets for spreadsheets, BI tools, or internal APIs.

📦 Data you can extract

Each dataset row is one successfully scraped GitHub Security Advisory. Fields can include:

• ghsaId, cveIds, title, classification, and severity
• description, public advisory url, and source apiUrl
• publishedAt, updatedAt, reviewedAt, nvdPublishedAt, withdrawnAt, and scrapedAt
• cvss score and vector
• epss percentage and percentile when GitHub provides them
• cwes with CWE IDs and names
• affectedPackages with ecosystem, package name, vulnerable version range, patched versions, vulnerable functions, repository URL, and source-code locations
• references, credits, and repositoryAdvisoryUrls

Missing source values are returned as null or empty arrays. The Actor does not invent CVE, CVSS, EPSS, CWE, package, patch, credit, or timestamp facts.

🚀 How to run it

1. Open the Actor input.
2. Choose Advisory feed for recent or filtered GHSA exports, or choose Exact advisory lookup for known GHSA or CVE identifiers.
3. Add optional filters for classification, severity, package ecosystem, affected package, CWE, publication dates, update dates, withdrawn status, ordering, or maximum advisory results.
4. Add a GitHub token only when you want higher limits for larger public GitHub API pulls.
5. Run the Actor and open the dataset.

Normal public runs do not require a GitHub account or token.

⚙️ Input options

Field	What it does
target	Chooses whether to collect a filtered advisory feed or look up exact GHSA or CVE identifiers.
advisoryIds	Looks up one or more exact GHSA or CVE identifiers when Target is Exact advisory lookup.
classification	Filters feed results by GitHub advisory classification: any, general, or malware.
severity	Filters feed results by source-native severity.
ecosystem	Filters feed results by package ecosystem when GitHub exposes the ecosystem filter.
packageName	Filters feed results to advisories for one affected package name.
cwe	Filters feed results by a CWE identifier such as CWE-79.
publishedFrom, publishedTo	Filters by advisory publication date.
updatedFrom, updatedTo	Filters by advisory update date.
includeWithdrawn	Includes advisories GitHub marks as withdrawn in feed results.
orderBy	Orders feed results before the result limit is applied.
maxResults	Caps the number of advisory records returned.
githubToken	Optional token for larger public GitHub API pulls.

Example feed input:

{
  "target": "advisoryFeed",
  "severity": "high",
  "ecosystem": "npm",
  "publishedFrom": "2026-01-01",
  "orderBy": "publishedDesc",
  "maxResults": 25
}

Exact advisory lookup:

{
  "target": "exactAdvisoryLookup",
  "advisoryIds": ["GHSA-jfh8-c2jp-5v3q", "CVE-2021-44228"],
  "maxResults": 5
}

📄 Output example

{
  "ghsaId": "GHSA-jfh8-c2jp-5v3q",
  "cveIds": ["CVE-2021-44228"],
  "title": "Remote code injection in Log4j",
  "classification": "general",
  "severity": "critical",
  "description": "Apache Log4j2 versions 2.0-beta9 through 2.15.0 are vulnerable to remote code execution.",
  "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
  "apiUrl": "https://api.github.com/advisories/GHSA-jfh8-c2jp-5v3q",
  "publishedAt": "2021-12-10T00:00:35Z",
  "updatedAt": "2025-01-14T08:36:01Z",
  "reviewedAt": "2021-12-10T00:00:00Z",
  "nvdPublishedAt": "2021-12-10T10:15:09Z",
  "withdrawnAt": null,
  "cvss": {
    "score": 10,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  "epss": {
    "percentage": 0.94321,
    "percentile": 0.99874
  },
  "cwes": [
    {
      "id": "CWE-20",
      "name": "Improper Input Validation"
    }
  ],
  "affectedPackages": [
    {
      "ecosystem": "maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "vulnerableVersionRange": ">= 2.0-beta9, < 2.3.2",
      "patchedVersions": ["2.3.2"],
      "vulnerableFunctions": [],
      "repositoryUrl": "https://github.com/apache/logging-log4j2",
      "sourceCodeLocations": []
    }
  ],
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
    }
  ],
  "credits": [
    {
      "name": "chenzhaojun",
      "type": "reporter"
    }
  ],
  "repositoryAdvisoryUrls": [
    "https://github.com/apache/logging-log4j2/security/advisories/GHSA-jfh8-c2jp-5v3q"
  ],
  "scrapedAt": "2026-07-07T12:00:00.000Z"
}

💳 Pricing

This actor uses pay-per-event pricing. You are charged only when the actor saves an accepted advisory to the dataset. Empty runs and setup checks should not be described as charged unless the pricing handoff says otherwise.

🔌 Integrations

Use this actor with Apify integrations, API clients, webhooks, scheduled runs, and dataset exports. Send results to spreadsheets, BI tools, databases, or your own app after each run.

❓ FAQ

🔎 Can this work as a GitHub Security Advisories scraper with the GitHub API?

Yes. It collects public GitHub Security Advisory records and saves structured Apify dataset rows, including source API URLs when available.

🧩 Does it support both CVE and GHSA lookup?

Yes. Enter exact GHSA or CVE IDs in advisoryIds to look up known advisories, or collect a feed with filters when you need broader discovery.

📦 Can I filter by package or ecosystem?

Yes. Feed runs can filter by package ecosystem and affected package name when GitHub exposes matching controls for those advisories.

🔑 Do I need a GitHub token?

No for normal public runs. A GitHub token is optional and is useful when you need larger public API pulls.

🛑 What happens when no advisory matches my input?

The run can finish without saving advisory rows. Pricing is based on successfully saved advisory results, not empty searches or no-result setup checks.

📥 Can I download the GitHub advisory database?

You can export the rows collected by each run from the Apify dataset in standard Apify export formats and use filters plus maxResults to control each run.

⚙️ Why not use the GitHub API directly?

Use the GitHub API directly when you want to build and maintain your own integration. Use this Actor when you want Apify inputs, datasets, exports, schedules, webhooks, and repeatable runs around the same public advisory source.

🧭 Does this include NVD, OSV, CISA KEV, or other vulnerability sources?

No. This Actor stays focused on GitHub Security Advisories and does not merge other vulnerability databases into the output.

📝 Changelog

• 0.0.1: Initial release.

🆘 Support

For issues, questions, or feature requests, file a ticket and I'll fix or implement it in less than 24h 🫡

🔗 Other actors

• OpenSSF Scorecard Projects Scraper ↗ - Use it for related github and security workflows.
• CISA KEV Scraper ↗ - Use it for related cve and affected workflows.
• Semver Parser & Version Range Checker ↗ - Use it for related versions and package workflows.
• ORCID Researcher Profile Search ↗ - Use it for related lookup workflows.
• Apple App Store Scraper ↗ - Use it for related lookup and versions workflows. Made with ❤️ by Maxime Dupré