A database of CVEs and GitHub-originated security advisories affecting the open source world.

The database is free and open source and is a tool for and by the community.

Submit pull requests to help improve our database of software vulnerability information for all.

• To provide a free and open-source repository of security advisories.
• To enable our community to crowd-source their knowledge about these advisories.
• To surface vulnerabilities in an industry-accepted formatting standard for machine interoperability.

All advisories acknowledged by GitHub are stored as individual files in this repository. They are formatted in the Open Source Vulnerability (OSV) format.

You can submit a pull request to this database (see, Contributions) to change or update the information in each advisory.

Pull requests will be reviewed and either merged or closed by our internal security advisory curation team. If the advisory originated from a GitHub repository, we will also @mention the original publisher for optional commentary.

We add advisories to the GitHub Advisory Database from the following sources:

• Security advisories reported on GitHub
• The National Vulnerability Database
• The npm Security Advisories Database
• The FriendsOfPHP Database
• The Go Vulnerability Database