GitHub Security Advisories (GHSA) by Ecosystem

Pull recent GitHub Security Advisories, the reviewed advisory database behind github.com/advisories, as a date filtered dataset. One row per advisory and ecosystem, with the affected packages, vulnerable version ranges and fix versions in structured form.

No token needed: without one the actor reads the same advisories from OSV.dev, the open vulnerability database that carries every reviewed GitHub advisory record for record.

What you get

{
  "ghsaId":         "GHSA-r825-w8mm-5pxw",
  "summary":        "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
  "description":    "Full advisory text in Markdown ...",
  "severity":       "MODERATE",
  "classification": "GENERAL",
  "publishedAt":    "2026-10-20T19:51:52Z",
  "updatedAt":      "2026-10-20T20:00:04Z",
  "withdrawnAt":    null,
  "url":            "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
  "cves":           ["CVE-2026-112944"],
  "references":     ["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw",
                     "https://nvd.nist.gov/vuln/detail/CVE-2026-112944"],
  "cwes":           [{"cweId": "CWE-88", "name": null}],
  "ecosystem":      "NPM",
  "affected": [
    {"package": "launch-editor", "vulnerableRange": "<= 2.14.1", "firstPatchedVersion": "2.14.2"},
    {"package": "vite", "vulnerableRange": ">= 7.0.0, <= 7.3.6", "firstPatchedVersion": "7.3.7"},
    {"package": "vite", "vulnerableRange": "<= 6.4.3", "firstPatchedVersion": "6.4.4"}
  ],
  "source":         "osv.dev"
}

vulnerableRange uses GitHub's notation. firstPatchedVersion is null while no fixed release exists. cwes[].name is filled when you give a GitHub token (GitHub's API returns the names; OSV.dev has the ids only).

With ALL instead of a list of ecosystems you get one row per advisory: ecosystem is null, ecosystems lists every affected ecosystem and each affected entry carries its own ecosystem.

How to use

{
  "ecosystems": ["NPM", "PIP", "MAVEN"],
  "sinceDays":  7,
  "maxResults": 500
}

ecosystems: any of NPM, PIP, MAVEN, COMPOSER, NUGET, RUBYGEMS, RUST, GO, PUB, ERLANG, ACTIONS, SWIFT, or ALL. An advisory that affects two of the listed ecosystems gives two rows.

sinceDays: advisories published in the last N days (1 to 730).

maxResults: the most rows one run returns. When more advisories match, the run keeps the most recently updated ones, newest publication first.

githubToken (optional): a GitHub token makes the actor query GitHub's GraphQL API directly, which adds the CWE names. A classic token with no scopes works. If GitHub refuses the token, the run reads OSV.dev instead.

Schedule the actor daily with sinceDays: 1 for a feed of new advisories into Slack, Jira or your own dashboard.

Pricing

Pay per event. Price per 1,000 events:

Event	Base price	Bronze	Silver	Gold
GitHub security advisory extracted	$0.50	$0.45	$0.40	$0.35

Bronze, Silver and Gold are the discounts Apify gives users of its paid plans. The Pricing tab always shows the current prices.

Who uses it

• AppSec and product security teams tracking new advisories for their stack.
• DevOps teams building their own dependency pinning rules.
• Supply chain auditors keeping a weekly snapshot.
• Compliance and risk dashboards.

Run it through the API

Python, with the apify-client package:

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("v0iddo/github-security-advisories").call(run_input={"ecosystems": ["NPM", "PIP"], "maxResults": 20})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript, with the apify-client package:

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('v0iddo/github-security-advisories').call({"ecosystems": ["NPM", "PIP"], "maxResults": 20});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

One HTTP call that waits for the run and returns the rows (for runs that finish within 5 minutes):

curl -X POST "https://api.apify.com/v2/acts/v0iddo~github-security-advisories/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"ecosystems": ["NPM", "PIP"], "maxResults": 20}'

Use it from an agent (MCP)

Claude, Cursor, VS Code and other MCP clients can call this actor as a tool through the Apify MCP server. Add it to the client's MCP configuration:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com?tools=v0iddo/github-security-advisories",
      "headers": {
        "Authorization": "Bearer <YOUR_APIFY_TOKEN>"
      }
    }
  }
}

FAQ

Do I need an account, cookies or an API key?

No. The actor works without one. GitHub token (optional) is optional and stored as a secret input; the note under the field on the Input tab says when it helps.

How many results can one run return?

Set Max rows total (up to 50,000) to the number you need. Large jobs can also be split into several runs or scheduled.

How am I charged?

Pay per event, at the prices on the Pricing tab for your Apify plan (the Pricing section of this page lists them). The platform usage of the run is included in those prices, and your spending limit for a run is always respected.

Why did my run return no results?

The status message and the log of the run say why: usually nothing matched the input, or the source did not answer for a moment. Check the input against the example above and run it again.

Can I run it on a schedule?

Yes. Save your input as a task and add a schedule in the Apify Console (daily, hourly or with a cron expression). Each run gets its own dataset, so you keep a history.

Which formats can I export?

JSON, CSV, Excel, XML, HTML table and RSS from the Output tab or the API. Integrations send the rows to Google Sheets, Slack, Make, Zapier, n8n or a webhook.

Is collecting this data allowed?

The actor collects data that the source publishes openly, without a login. Public data can still be personal data under laws such as the GDPR, and sources have their own terms: make sure your use of the data follows the rules that apply to you.

What happens when the source changes?

An automated test runs the actor every day on the example input and checks the rows, not only that the run finished. When a check fails, the actor is repaired and rebuilt; the build history on this page shows each update.

Something is missing or wrong. Where do I report it?

Open an issue on the Issues tab of this actor with the run link. Requests for a new field are welcome too.

Related actors

• npm Package Stats Scraper: Metadata and Downloads
• GitHub Trending Scraper: Repos by Language and Period
• NVD CVE Scraper: Vulnerabilities by Vendor and Severity
• Product Hunt Scraper: Daily Launches
• App Store Scraper: App Details, Ratings, Prices
• App Store Search Scraper: Apps by Keyword

Source

GitHub's reviewed advisory database, read from OSV.dev (osv-vulnerabilities.storage.googleapis.com change lists and api.osv.dev records), or from GitHub's GraphQL securityAdvisories when a token is given. Both are public data.