OSV Vulnerabilities Scraper

Look up known security vulnerabilities for open-source packages — CVE and GHSA IDs, summary, CVSS severity, references, and dates — from the official OSV.dev API: no API key or setup needed.

Give it a list like npm:lodash, PyPI:django, Maven:org.apache.logging.log4j:log4j-core, and get a clean, dated table of every advisory affecting each package — ready to export to CSV, Excel, or JSON, or to power a dependency-security monitor.

Features

• Official, reliable source — reads the public OSV.dev query API (Google's Open Source Vulnerabilities database).
• Every ecosystem — npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Composer, Debian, Alpine.
• CVE & GHSA — each row carries the OSV/GHSA id plus mapped CVE ids and CVSS severity.
• Monitoring-ready — schedule it on your dependency list and catch new advisories as they publish.

Use cases

• Dependency security audits — scan a project's package list for known vulnerabilities.
• Continuous monitoring — schedule daily and alert on new advisories for your stack.
• Supply-chain research — build datasets of vulnerabilities by ecosystem, package, or severity.
• Compliance & reporting — export CVE/GHSA evidence with dates and references.

Input

Field	Type	Description
packages	string[]	Entries in ecosystem:name format, e.g. npm:lodash, PyPI:django. Ecosystem is everything before the first colon.
includeWithdrawn	boolean	Include withdrawn/retracted advisories. Default false.
maxItems	integer	Max vulnerabilities per package. Default 1000.

Ecosystem names are case-sensitive: npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Composer, Debian, Alpine. Common aliases are normalized (pypi/pip → PyPI, cargo/crates → crates.io, gem → RubyGems, composer → Packagist, golang → Go).

Example

{
  "packages": ["npm:lodash", "PyPI:django", "Maven:org.apache.logging.log4j:log4j-core"],
  "includeWithdrawn": false,
  "maxItems": 1000
}

Output

{
  "ecosystem": "npm",
  "package": "lodash",
  "vulnId": "GHSA-29mw-wpgm-hmr9",
  "aliases": ["CVE-2020-28500"],
  "cveIds": ["CVE-2020-28500"],
  "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
  "details": "All versions of package lodash prior to 4.17.21 are vulnerable to ReDoS…",
  "severityCvss": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
  "publishedAt": "2022-01-06T20:30:46Z",
  "modifiedAt": "2025-09-29T21:12:31.102523Z",
  "withdrawn": null,
  "references": ["https://nvd.nist.gov/vuln/detail/CVE-2020-28500"],
  "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
  "scrapedAt": "2026-08-11T19:00:00.000Z"
}

Download the dataset as JSON, CSV, Excel, or XML, or pull it via the Apify API.

Pricing

Pay-per-event: $0.01 per run start (per GB of run memory) plus $0.50 per 1,000 vulnerabilities. You only pay for vulnerabilities actually returned. See the Pricing tab for current rates.

FAQ

Do I need an API key? No. OSV.dev's query API is public and free; this Actor packages it into clean, dated rows with detail links.

Which ecosystems are supported? npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet, Packagist, Pub, Hex, Composer, Debian, Alpine — anything OSV.dev indexes.

Can I filter to a specific version? This Actor returns all advisories for a package. Filter by the affected ranges in your own pipeline if needed.

Can I monitor for new vulnerabilities? Yes — schedule the Actor (e.g. daily) with your dependency list.

Disclaimer

This Actor uses the public OSV.dev API. It is not affiliated with or endorsed by OSV.dev, Google, or any advisory database. The data is public; you are responsible for how you use it.