OSV

OSV (Open Source Vulnerabilities) is an open, distributed vulnerability database and security service for open source software. It aggregates advisories from databases that use the OpenSSF OSV format, including GitHub Security Advisories, PyPA, RustSec, and the Global Security Database. Its structured records are designed to be both human- and machine-readable, mapping vulnerabilities precisely to affected package versions or commit hashes across a broad range of ecosystems.

OSV helps developers and organizations find and address risks in their projects. Users can search the vulnerability database or query its API by package version or commit hash. The project also offers OSV-Scanner, a tool for scanning software bills of materials, lockfiles, project directories, and container images for known vulnerabilities. Guided remediation features help update affected dependencies, while reusable GitHub workflows support ongoing scans in pull requests and CI/CD pipelines. OSV publishes its schema and documentation, and maintains a blog and FAQ to help users understand the database and tools. As an open-source project, it welcomes questions and ideas through issue submissions.