OSV.dev / Package Advisories

Known vulnerabilities for one open-source package, optionally at one version: every matching OSV record (id, summary, details, aliases such as CVE and GHSA ids, affected ranges, severity, references), direct from OSV.dev's POST /v1/query. package.ecosystem is case-sensitive and must be an OSV ecosystem name (npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, ...). Omit version to list every advisory for the package. A package with no known vulnerabilities answers an empty object. Read-only even though it is a POST: the query travels in the body. Paginates past 1,000 results or 20 s of server time: pass the reply's next_page_token back as page_token. Data credit: records keep their source's license, mostly CC-BY 4.0 (GitHub Advisory Database, PyPI, Go, OSS-Fuzz) or CC0; see https://google.github.io/osv.dev/data/. Chainguard and Wolfi records (CC-BY-NC-ND 4.0) are not served: their licence forbids commercial use.