OSV Open Source Vulnerabilities Scraper

OSV Open Source Vulnerabilities Scraper

Scrape open source vulnerability records from the OSV catalogue by package, version, commit, or ID, up to a million per run. Each record includes its aliases, affected versions, severity scores, and fixed commits. No API key. Export to CSV, JSON, Excel, or XML.

Tracking every CVE, GHSA, and ecosystem advisory across your dependencies is a manual slog. The OSV catalogue aggregates advisories from PyPI, npm, Go, Maven, and 25 other ecosystems into one database, and this Actor queries it directly. Feed it a package name, a version, a commit hash, or a list of vulnerability IDs, and it returns the full advisory record for each match.

Who uses it	What they scrape OSV for
DevSecOps engineers	Audit a dependency manifest against known vulnerabilities before a release.
Security researchers	Pull every advisory for a package to study its vulnerability history.
Compliance teams	Generate a list of CVEs affecting a specific version of a library for a regulatory report.
Platform engineers	Feed a vulnerability scanner with fresh OSV data for every container image build.

What it does

This Actor collects open source vulnerability records from the OSV catalogue by package, version, commit, or vulnerability ID, and returns each advisory as a flat row.

• 📦 Package query: search by package name and ecosystem, with an optional version pin.
• 🔎 Cross-package version search: supply only a version to find every vulnerability affecting that version across all packages.
• 🔗 Commit search: look up advisories by a Git commit SHA.
• 🆔 ID lookup: fetch a single advisory by its ID, or batch up to 100 IDs in one run.
• 🌐 Multi-ecosystem coverage: PyPI, npm, Go, Maven, RubyGems, crates.io, NuGet, Packagist, and 20 more.
• 📊 Full advisory record: aliases, affected ranges, severity scores, fixed commits, and references.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with OSV data

🛡️ Audit a dependency before release.

A DevSecOps engineer runs the Actor with a package name and version to list every advisory affecting that release, then blocks the pipeline if any critical CVEs appear.

📋 Build a vulnerability report for compliance.

A compliance officer feeds a list of CVE and GHSA IDs into the batch lookup mode and exports the full advisory details to attach to a regulatory filing.

🔬 Research a package's security history.

A security researcher queries a package across all versions to map its vulnerability timeline and identify recurring weakness patterns.

⚙️ Integrate OSV data into a scanner.

A platform engineer schedules the Actor to pull fresh advisories for every package in a container image and feeds the results into an internal vulnerability database.

Why choose this scraper

	What you get
No API key	Query the OSV catalogue directly with no registration or rate limits.
Batch lookups	Resolve up to 100 vulnerability IDs in a single run.
Fixed schema	Every advisory lands as a flat row ready for a database or spreadsheet.

How it compares

No other Store actor targets OSV the same way, so the honest comparison is with the alternatives teams actually weigh.

	OSV Open Source Vulnerabilities Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When OSV changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor from a package name, a version, a commit hash, or a list of vulnerability IDs, and set a maximum items limit so only the records you need reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "mode": "query",
  "packageName": "requests",
  "ecosystem": "PyPI",
  "maxItems": 10
}

A larger pull:

{
  "mode": "query",
  "packageName": "requests",
  "ecosystem": "PyPI",
  "maxItems": 200
}

Pricing

Pay-per-result: $0.0305 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$3.05
1,000 results	$30.50
10,000 results	$305.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the OSV Open Source Vulnerabilities Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to OSV through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/osv-vulnerabilities-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results for my package?

Check that the package name matches the ecosystem's canonical name exactly (e.g., 'lodash' not 'Lodash'). Also try leaving the ecosystem set to 'All ecosystems' to widen the search.

Why does my version search return vulnerabilities for other packages?

When you supply a version without a package name, the OSV catalogue performs a cross-package search. Add a package name to restrict results to that package only.

The batch lookup only returned some of my IDs.

The OSV API may not have records for every ID you supplied. Check that the IDs are valid and publicly listed. The Actor returns whatever the API finds.

I hit the maximum items limit but I need more data.

Increase the 'Maximum vulnerabilities' field up to 1,000,000 and re-run. If you need more than the API can return in one query, split your search into smaller chunks by ecosystem or version range.

The output is missing a CVSS score.

Not every OSV advisory includes a CVSS score. The Actor returns the record as-is. Check the advisory on osv.dev to confirm whether a score exists upstream.

FAQ

Question	Answer
What is the OSV catalogue?	It is a distributed vulnerability database that aggregates advisories from language ecosystems (PyPI, npm, Go, etc.) and Linux distributions into one searchable API. Each advisory links to its upstream source.
Do I need an API key?	No. The Actor queries the public OSV API with no authentication, no registration, and no rate limits.
Can I search by CVE ID?	Yes. Use the 'Fetch by vulnerability ID' mode and supply a CVE ID like CVE-2021-44228. The Actor returns the full OSV record, which includes aliases and ecosystem-specific identifiers.
How do I batch-lookup multiple IDs?	Switch to 'Fetch by vulnerability ID' mode and paste a list of IDs into the 'Vulnerability IDs (batch lookup)' field. The Actor resolves up to about 100 IDs per run.
What ecosystems are supported?	Over 30 ecosystems, including PyPI, npm, Go, Maven, RubyGems, crates.io, NuGet, Packagist, OSS-Fuzz, Hex, Pub, and several Linux distributions.
Can I search by a version without a package name?	Yes. If you supply only a version, the OSV catalogue returns every vulnerability affecting that version string across all packages. This is useful for finding cross-package version collisions.
How many vulnerabilities can I collect in one run?	You set the maximum with the 'Maximum vulnerabilities' field, up to 1,000,000. The Actor stops when it hits that number or when the API has no more results.
Does this Actor return severity scores?	Yes. When the advisory includes a CVSS score, it appears in the output. Not every advisory has a score; the Actor returns whatever the OSV record contains.
Can I search by a commit hash?	Yes. Use the 'Commit Hash' field in query mode. The OSV API maps the commit to any vulnerabilities that introduced or fixed it.
What export formats are supported?	The Apify platform exports your dataset to CSV, JSON, Excel, XML, and several other formats from the run console.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Open Source Vulnerabilities project. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.