osv.devtoolOSV
OSV.dev is an open, distributed vulnerability database using the OpenSSF OSV schema to describe vulnerabilities precisely mapped to package versions or commit hashes, aggregating sources like GitHub Security Advisories, PyPA, RustSec, and the Global Security Database. It provides a free query API (by commit hash or package version) and the OSV-Scanner CLI/GitHub Actions workflows to scan SBOMs, lockfiles, container images, and repositories for known vulnerabilities, with an experimental `fix` command for automated remediation.
TL;DR Open-source, OpenSSF-backed vulnerability database and scanner (OSV-Scanner) covering package ecosystems, SBOMs, lockfiles, and container images.
CVEs named here
- CVE-2022-27651
Technologies named here
- github.com/containers/buildah
- OSV
- OSV API
- OSV-Scanner
- OSV-Scanner GitHub workflows
- GitHub Actions
- Docker
- Go
- PyPI
- SBOM
Related in Supply Chain
