OSV Vulnerability Scraper

Find package vulnerabilities, affected versions, fixed releases, severity, aliases, and advisory links across major open-source ecosystems.

What you get

Check exact package versions or package names against the aggregated OSV vulnerability database. Every result preserves the advisory identity, affected-version evidence, fixes, references, and source attribution needed for dependency review, software inventory enrichment, and remediation queues.

Output fields

Field	Description
id	Primary OSV advisory identifier
aliases	CVE, GHSA, PYSEC, and other aliases
summary / details	Published vulnerability explanation
published / modified / withdrawn	Advisory lifecycle timestamps
severity / severity_label	Published severity data when available
affected_packages	Ecosystems, packages, ranges, and affected versions
fixed_versions	Distinct fixed versions found in affected ranges
references	Advisory, patch, report, and source links
credits	Published vulnerability credits
matched_input	Package or advisory input that produced the row
source_url / source	OSV record link and attribution

Example output

{
  "id": "GHSA-9hjg-9r4m-mvj7",
  "aliases": ["CVE-2024-47081"],
  "summary": "Requests vulnerable to credential disclosure through crafted URLs",
  "severity_label": "MODERATE",
  "fixed_versions": ["2.32.4"],
  "matched_input": "PyPI:requests@2.31.0",
  "source_url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
}

Input parameters

Parameter	Required	Description
packages	No	Packages as Ecosystem:name or Ecosystem:name@version.
vulnerabilityIds	No	Exact OSV, GHSA, CVE, PYSEC, or ecosystem advisory IDs.
maxResultsPerPackage	No	Maximum advisories per package entry. Defaults to 10.

Use cases

• Security teams: turn software inventories into source-linked remediation queues.
• Engineering teams: check package versions before upgrades or releases.
• Compliance teams: retain advisory evidence for software supply-chain reviews.
• Developers: enrich SBOM, dependency, and asset-management workflows.

Export OSV package vulnerabilities without an API key

Use package-and-version inputs for dependency checks or exact advisory IDs for enrichment. The public source needs no credential, and every saved row retains upstream references for verification.

Limitations

OSV aggregates upstream databases with different coverage, licenses, severity conventions, and update schedules. A missing result does not prove a package is safe. Git commit queries and repository scanning are outside this Actor's scope. Confirm remediation decisions against the upstream advisory and your deployed environment.

Compared to alternatives

Compared with crawlerbros/osv-vulnerabilities-scraper, this Actor accepts package checks and exact advisory IDs together and keeps a low 10-result default. Compared with a general NVD search, OSV maps advisories to open-source package ecosystems and version ranges. Store pricing and features can change.

FAQ

Which ecosystems work?

OSV covers npm, PyPI, Go, Maven, NuGet, crates.io, RubyGems, Packagist, Linux distributions, and other published ecosystems. Ecosystem names must match OSV naming.

Can I check a specific version?

Yes. Use a value such as npm:lodash@4.17.20.

Is this a security scanner?

No. It returns known published advisories for supplied identifiers; it does not inspect systems or prove exploitability.

Explore more at thirdwatch.dev. Related Actors: NVD CVE Scraper, PyPI Package Scraper, and npm Package Scraper.

Last verified: 2026-07