Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven avatar

Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven

Pricing

from $1.00 / 1,000 vulnerabilities

Try for free
Go to Apify Store
Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven

Open Source Vulnerability Scanner: CVEs for npm, PyPI, Maven

Try for free

Find known vulnerabilities (CVE, GHSA) for packages and versions in npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist and more, via OSV.dev, with CVSS scores, fixed versions and CISA known-exploited flags.

Pricing

from $1.00 / 1,000 vulnerabilities

Rating

0.0

(0)

Developer

Pankaj Bhatia

Pankaj Bhatia

Maintained by Community

Actor stats

0

Bookmarked

2

Total users

1

Monthly active users

5 days ago

Last modified

Categories

Developer tools

Automation

Share

Check open-source packages for known security vulnerabilities. Enter packages such as npm:lodash@4.17.15, PyPI:django@3.2.0 or Maven:org.apache.logging.log4j:log4j-core@2.14.1, and the tool returns every vulnerability that affects that version. Each row includes the ID (GHSA, CVE, PYSEC, RUSTSEC, GO), summary, details, severity and a calculated CVSS v3 base score, CWE IDs, affected ranges and fixed versions, plus a known-exploited flag from the CISA KEV catalog (with ransomware use and the remediation due date). Data comes from OSV.dev, the open vulnerability database run by Google, which covers npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, Hex, Pub, Debian, Alpine, Ubuntu and more. No login or API key is needed.

Who is it for?

  • Developers and DevSecOps teams checking dependencies in CI or before releases.
  • Security analysts who need to prioritise fixes using CVSS and the CISA exploited list.
  • Compliance and procurement teams producing vulnerability reports for software they use.
  • Security newsletters and dashboards that track newly exploited CVEs.

How to use it

  1. List packages as ecosystem:name@version. Leave out the version to get every known vulnerability for the package.
  2. Optionally add vulnerability IDs (for example CVE-2021-44228) to look them up directly.
  3. Optionally set CISA KEV: added in last N days to list newly exploited vulnerabilities.
  4. Filter by minimum severity or only known exploited, then click Start.

Input example

{"packages": ["npm:lodash@4.17.15", "PyPI:django@3.2.0"], "minSeverity": "high", "kevAddedLastDays": 30}

Output example

{"id": "GHSA-r5fr-rjxr-66jc", "cveIds": ["CVE-2026-4800"], "package": "lodash", "ecosystem": "npm", "queriedVersion": "4.17.15", "severity": "high", "cvssV3Score": 8.1, "fixedVersions": ["4.18.0"], "knownExploited": false, "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"}

How much does it cost?

Pay-per-event: a small fee per vulnerability returned, plus a tiny per-run start fee. There is no subscription and no separate platform usage cost. For example, 1,000 vulnerabilities cost about $1. Searches with no matches and error rows are not charged. Use Max results or Maximum cost per run to cap your spending.

Use it through the API, integrations or AI agents

Run it from the Apify API, on a schedule, or connect it to Make, Zapier, n8n or Google Sheets. AI agents can find and call it through the Apify MCP server. Output is clean JSON with the same fields on every run.

FAQ

Is it legal? Yes. OSV.dev data is published under the Creative Commons Attribution 4.0 licence through a free public API, and the CISA KEV catalog is U.S. government public data. No personal data is involved.

Is a package with no results safe? Not always. No results means no known vulnerability is recorded in OSV for that version. Clean packages return a free "no known vulnerabilities" row.

Why are some severities empty? Some advisories (often older PYSEC or Go entries) have no CVSS score. GitHub advisories usually do, so the tool puts GHSA entries first and removes duplicates that share the same CVE.

What package names should I use? Use the ecosystem's own name, for example Maven:group:artifact, Go:github.com/gin-gonic/gin, crates.io:tokio or npm:@angular/core.

Does it scan my code? No. It checks the package names and versions you give it.

More tools from this developer

You might also like

NVD CVE Vulnerability Search avatar

NVD CVE Vulnerability Search

ryanclinton/nvd-cve-vulnerability-search

NVD CVE Vulnerability Search queries the NIST National Vulnerability Database (NVD) REST API v2.0 to retrieve detailed information about Common Vulnerabilities and Exposures (CVEs). The NVD is the U.S.

User avatar

Ryan Clinton

20

CISA Known Exploited Vulnerabilities Search avatar

CISA Known Exploited Vulnerabilities Search

ryanclinton/cisa-kev-search

Search and filter the official CISA Known Exploited Vulnerabilities (KEV) catalog -- the authoritative U.S. government list of vulnerabilities actively exploited in the wild.

User avatar

Ryan Clinton

6

NVD CVE Vulnerability Search - Vendor Risk Diligence API avatar

NVD CVE Vulnerability Search - Vendor Risk Diligence API

pink_comic/nvd-cve-vulnerability-database

Search NIST NVD CVEs by keyword, severity, vendor, or date for vendor-risk diligence and patch workflows. CVSS, affected products, and source-linked vulnerability evidence — not proof a deployment is exploitable. Related: CISA KEV catalog, SSL certificate checker.

User avatar

Ava Torres

6

SV

Security Vulnerability Tracker (CVE)

scrapemint/cve-vulnerability-tracker

Track software security vulnerabilities from the US government NVD: search CVEs by keyword, vendor, product and severity, each row with CVSS score, CISA known-exploited flag and EPSS exploit probability. Monitor mode for new CVEs. No API key.

User avatar

Ken M

3

5.0

(1)

OS

Open Source Vulnerability Scraper (OSV.dev)

chrisp1211/vulnerability-scraper-max

Look up open-source security vulnerabilities from OSV.dev for any package across npm, PyPI, Go, Maven, crates and more. Returns CVE IDs, severity, summary and references. No API key. Pay per vulnerability; empty runs free.

User avatar

Christian Pichichero

3

CV

CVE Vulnerability Monitor (NVD)

agentictools/cve-vulnerability-monitor

Search and monitor CVE vulnerabilities from the NVD by keyword, product, severity, or date, with CVSS scores and references.

User avatar

Ken Agland

3

OSV Scraper | Open-Source Package Vulnerabilities (CVE) avatar

OSV Scraper | Open-Source Package Vulnerabilities (CVE)

muzafferkadir/osv-vulnerabilities-scraper

Look up known security vulnerabilities (CVE/GHSA) for open-source packages — npm, PyPI, Go, Maven & more — via the official OSV.dev API: severity, references, dates. No API key.

User avatar

Muzaffer Kadir YILMAZ

2

OSV-Scanner Vulnerability Checker avatar

OSV-Scanner Vulnerability Checker

ayeeyee/osv-scanner-vulnerability-checker

Scan a git repository dependency manifests, package-lock.json, requirements.txt, go.sum, and more, against Google OSV.dev vulnerability database using OSV-Scanner. Get cross-ecosystem CVE matching across npm, PyPI, Go, Maven, and other package registries. $0.49 per completed scan.

User avatar

Virtual Footprint LLC

2

OSV Package Vulnerability Scanner avatar

OSV Package Vulnerability Scanner

technicaldost/osv-package-vulnerability-scanner

Returns known vulnerabilities from the OSV database for packages in npm, PyPI, Maven, Go, NuGet, RubyGems and crates.io: vulnerability ID, aliases (CVE), severity, summary and fixed versions. Input: package names and versions.

User avatar

Technical Dost Solutions

2

OSV Vulnerability Scraper - Package Security Advisories avatar

OSV Vulnerability Scraper - Package Security Advisories

thirdwatch/osv-vulnerability-scraper

Find known vulnerabilities for npm, PyPI, Maven, Go, NuGet, Cargo, RubyGems, and other packages. Export advisory IDs, affected versions, fixes, severity, references, and source links.

User avatar

Thirdwatch

2