GitHub Security Advisories Scraper

GitHub Security Advisories Scraper

Scrape GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, or date range, up to a million per run. Every advisory comes with its full description, affected packages, CVSS scores, CWE IDs, and references. No API key or login required. Export to CSV, JSON, Excel, or XML.

GitHub's official GraphQL API needs a personal access token and rate-limits you. This reads the public GitHub Security Advisories database directly, filtered by GHSA ID, CVE, ecosystem, severity, CWE, or date range, and returns each match in one fixed schema. It covers reviewed, unreviewed, and malware advisories across npm, Maven, pip, Go, and more.

Who uses it	What they scrape GitHub Security Advisories for
Security engineers	Which vulnerabilities affect the packages their applications depend on
DevSecOps teams	Monitoring new advisories for their tech stack to trigger patching workflows
Compliance officers	Auditing which CVEs and CWEs are present in their software inventory
Threat intelligence analysts	Tracking malware advisories and unreviewed reports across ecosystems
Open source maintainers	Checking if their packages appear in any advisory, including withdrawn ones

What it does

This Actor collects GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, CWE, or date range, and returns each one as a flat row.

• 🎯 GHSA ID lookup: fetch one advisory by its GHSA ID, or batch up to 100 IDs in a single run.
• 🔍 CVE and CWE filters: narrow to advisories linked to a specific CVE or a list of CWE numbers.
• 📦 Ecosystem and package filters: limit to npm, Maven, pip, Go, Rust, and more, or to specific packages and versions.
• 📅 Date ranges: filter by published, updated, or modified-after dates using ISO 8601 or range syntax.
• 🏷️ Type and severity: choose reviewed, unreviewed, or malware advisories, and filter by CVSS severity tier.
• 🚫 Withdrawn only: return only advisories that GitHub has withdrawn, useful for audit trails.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with GitHub Security Advisories data

🛡️ Monitor your dependencies.

A DevSecOps engineer runs the Actor daily with an ecosystem filter for npm and a severity of critical or high, then feeds new advisories into an alerting pipeline.

📋 Enrich a CVE list.

A security analyst passes a batch of CVE IDs to get the corresponding GHSA records, including affected packages and CVSS scores, for a vulnerability report.

🧪 Audit for malware advisories.

A threat researcher sets type to malware and ecosystem to pip to collect all Python malware advisories published in the last month.

📊 Track advisory trends.

A compliance officer filters by published date range and CWE IDs to see how many advisories match specific weakness classes over a quarter.

🔎 Verify a specific advisory.

An open source maintainer looks up a GHSA ID to check if their package is affected and whether the advisory has been withdrawn.

Why choose this scraper

	What you get
No API key	Uses the public GitHub Security Advisories database, no token or OAuth setup
Fixed schema	Every advisory returns the same flat fields, ready for CSV, JSON, Excel, or XML
Batch lookups	Pass up to 100 GHSA IDs in one run for efficient enrichment
Full coverage	Includes reviewed, unreviewed, and malware advisories, plus withdrawn ones

How it compares

No other Store actor targets GitHub Security Advisories the same way, so the honest comparison is with the alternatives teams actually weigh.

	GitHub Security Advisories Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When GitHub Security Advisories changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor from GHSA IDs, CVE IDs, ecosystems, severities, CWE numbers, or date ranges, alone or together, and filters run as each advisory is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10
}

A larger pull:

{
 "maxItems": 200
}

Pricing

Pay-per-result: $0.0315 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.15
1,000 results	$31.50
10,000 results	$315.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the GitHub Security Advisories Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to GitHub Security Advisories through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/github-security-advisories-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check your filters. If you set a CVE ID, ecosystem, severity, or date range, the combination may be too narrow. Try removing filters one at a time to see which one excludes all advisories.

Why does my batch lookup return fewer results than expected?

The ghsaIds field takes precedence over a single ghsaId. Make sure you are not setting both, and verify that each GHSA ID is spelled correctly. Some IDs may not exist or may be withdrawn.

Why do I get an error about the date format?

Use ISO 8601 format like '2023-01-01' or a range like '2023-01-01..2023-12-31'. For modifiedAfter, a single date is translated to '>=date', but a range is passed as-is.

Why are some fields empty in my results?

Not all advisories have every field. For example, unreviewed advisories may lack a GHSA ID or CVSS score. Check the advisory type and source.

Why does my run take a long time?

If you set a high maxItems and broad filters, the Actor may need to paginate through many advisories. Reduce maxItems or add more specific filters like ecosystem or severity.

Why do I get duplicate advisories?

If you pass overlapping filters, such as both a CVE ID and a GHSA ID, the same advisory may match multiple criteria. The Actor returns each advisory once per run, but check your input for redundancy.

FAQ

Question	Answer
Do I need a GitHub API token?	No. This Actor reads the public GitHub Security Advisories database directly, so no authentication or API key is required.
What is a GHSA ID?	A GHSA ID is GitHub's unique identifier for a security advisory, formatted like GHSA-xxxx-xxxx-xxxx. You can find it in the advisory URL or in the GitHub Advisory Database.
Can I fetch multiple advisories at once?	Yes. Use the ghsaIds field to pass an array of up to about 100 GHSA IDs in a single run.
What ecosystems are supported?	The Actor supports npm, Maven, pip, Go, Rust, RubyGems, Composer, NuGet, Swift, pub, Erlang/Elixir, GitHub Actions, and other.
How do I filter by severity?	Use the severity field and choose critical, high, medium, low, or unknown. The filter matches the CVSS severity tier of the advisory.
Can I filter by CWE?	Yes. Pass a comma-separated list of CWE numbers in the cwes field, such as '79,89,787'.
What date filters are available?	You can filter by published date, updated date, or modified-after date. Use ISO 8601 dates or ranges like '2023-01-01..2023-12-31'.
Does the Actor include withdrawn advisories?	By default, withdrawn advisories are included. Set isWithdrawn to true to return only withdrawn advisories.
What is the difference between reviewed and unreviewed?	Reviewed advisories are curated by GitHub and have a GHSA ID. Unreviewed advisories come from community sources and may not have a GHSA ID. Malware advisories are a separate type for malicious packages.
How many advisories can I collect in one run?	You can set maxItems up to 1,000,000. The default is 10.
What output formats are supported?	The Actor exports to CSV, JSON, Excel, and XML, with a fixed schema for every advisory.
Can I filter by affected package?	Yes. Use the affects field with a comma-separated list of packages, optionally with versions like 'package1,package2@1.0.0'.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by GitHub, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.