About
What OpenAdvisories is
One place to follow security advisories from vulnerability databases, national CERTs, Linux distributions and open-source ecosystems — and to check whether the versions you run are affected.
- Vulnerabilities
- 424,874
- Advisories
- 104,602
- Known exploited
- 1,786
- Malicious packages
- 240,346
What it does
Security information is scattered: the CVE program, CISA's exploited list, ENISA's EU database, national CERTs such as BSI, every Linux distribution's errata and the advisory databases of npm, PyPI, Maven and others. Each has its own format, naming and update rhythm.
OpenAdvisories collects these sources every hour, links records that describe the same vulnerability, and tags them by vendor, product, platform and package — so you can follow what matters to you without reading ten feeds.
- Browse and filter by severity, exploitation status, vendor, product or platform — every list has an Atom feed.
- Check a version of a package — from npm to Red Hat Enterprise Linux — against every known vulnerability.
- Scan a lockfile to find vulnerable and malicious dependencies, in the browser or from CI.
- Malicious packages: typosquats and hijacked releases reported by the OpenSSF.
Who it is for
System administrators keeping servers patched, developers and DevOps teams watching their dependencies, security teams triaging what to fix first, and anyone who wants a readable view of a CVE without a login.
What it is not
OpenAdvisories is an independent aggregator, not an official source. Records are shown as published by their source; mistakes or delays upstream show up here too. For decisions that matter, always confirm with the vendor's own advisory — every page links to it. See how the data is processed and its limits.
Free, no account, no tracking
Every page, feed and API endpoint is free to use without registration. There are no cookies, no analytics and no third-party scripts. Files you scan are processed in memory and never stored. Details: privacy policy.