# OpenAdvisories

> OpenAdvisories is a free, independent vulnerability intelligence platform. It merges more than 20 public sources (CVE program, CISA KEV and ICS advisories, FIRST EPSS, ENISA EUVD, national CERTs (BSI, NCSC-NL), vendor PSIRTs (Siemens, Schneider Electric, ABB, SICK), OSV.dev, Linux distributions, public exploit databases) into one record per vulnerability, enriched with exploitation status, exploit code and the fixed version per Linux release. On top it offers insight (trending, vendor patch days, weekly digest, vendor statistics) and tools (version checks, lockfile/SBOM/server scans, JSON API, daily push notifications). No account, no API key, no tracking. Data is refreshed hourly.

Key facts:

- One page per vulnerability, keyed by CVE ID (GHSA and EUVD IDs resolve to the CVE they alias): https://www.openadvisories.org/vuln/CVE-2024-3094
- Currently 426,176 vulnerabilities, 111,343 advisories, 1,790 known exploited, 240,671 malicious-package reports.
- "Exploited" means listed in CISA KEV or ENISA's EU exploited list. "Public exploit" means exploit code is published (Metasploit, Exploit-DB, GitHub PoCs; links only). EPSS is the probability of exploitation in the next 30 days.
- Severity comes from CVSS (the CNA's score first, then ADP/EUVD/OSV); the per-provider scores are kept separately.
- Distribution checks use the distribution's own fixed versions, because distributions backport fixes (a lower upstream version can be safe).
- Operated by Aurelius Julian Ballweber (Germany). Not affiliated with MITRE, CISA, FIRST, ENISA or any vendor. CVE® is a registered trademark of The MITRE Corporation.

When citing data, link the vulnerability page and credit the original source (listed on each record and on the data sources page).

## API (JSON, no key)

- [API documentation](https://www.openadvisories.org/api): all endpoints, parameters, response fields, errors and limits
- [Vulnerability record](https://www.openadvisories.org/api/vuln/CVE-2024-3094): `GET /api/vuln/{CVE|GHSA|EUVD id}` — merged record: description, CVSS scores per provider, KEV/EUVD exploitation, EPSS, CWEs, affected products, references
- [Check a package version](https://www.openadvisories.org/api/check/npm/lodash/4.17.20): `GET /api/check/{ecosystem}/{package}/{version}` — vulnerabilities and malware affecting that exact version, with the fixed version of each. Ecosystems: npm, packagist, maven, pypi, go, crates-io, nuget, rubygems, hex, github-actions, swifturl, hackage, pub
- [Check a distribution package](https://www.openadvisories.org/api/check/debian/12/openssl/3.0.11-1~deb12u2): `GET /api/check/{distro}/{release}/{package}/{full-version}`. Distributions: debian, ubuntu, alpine, almalinux, opensuse, suse, red-hat, rocky-linux
- Scan a lockfile or SBOM: `POST /api/scan` with the file as the body (max 5 MB, 5,000 packages — 10,000 for SBOMs — not stored). CycloneDX/SPDX JSON SBOMs (e.g. from syft or trivy for container images) are checked per component purl, OS packages against their distribution release. Types: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, composer.lock, Gemfile.lock, go.mod, Cargo.lock, packages.lock.json, gradle.lockfile, cyclonedx, spdx
- Scan a server: `POST /api/scan/server` with the installed-package list (dpkg, rpm or apk output plus /etc/os-release) as the body; `?format=text` for a terminal table
- Rate limit: about 60 requests per minute per IP (HTTP 429 when exceeded). CORS is open on JSON endpoints.

## Pages

- [Latest vulnerabilities](https://www.openadvisories.org/): newest first; filters are path segments, e.g. https://www.openadvisories.org/critical, https://www.openadvisories.org/exploited, https://www.openadvisories.org/exploit-available
- [Trending](https://www.openadvisories.org/trending): biggest EPSS rises this week, newly exploited CVEs, new public exploit code
- [Exploited](https://www.openadvisories.org/exploited): CISA KEV and ENISA exploited vulnerabilities
- [Public exploit available](https://www.openadvisories.org/exploit-available): vulnerabilities with published exploit or proof-of-concept code
- [Vendors](https://www.openadvisories.org/vendors): every vendor, product and package with its vulnerabilities, e.g. https://www.openadvisories.org/vendor/microsoft
- [Weekly digest](https://www.openadvisories.org/weekly): one summary per ISO week
- [Patch days](https://www.openadvisories.org/patch-day): Microsoft Patch Tuesday, Oracle CPU, Android bulletin, SAP, Adobe, Siemens, Fortinet, Intel — every release with its CVEs and zero-days, e.g. https://www.openadvisories.org/patch-day/microsoft (latest) or /patch-day/{vendor}/{YYYY-MM}
- [CWE](https://www.openadvisories.org/cwe): vulnerabilities grouped by weakness type
- [Archive](https://www.openadvisories.org/archive): vulnerabilities by publication date (year, month, day)
- [Malicious packages](https://www.openadvisories.org/malware): OpenSSF malicious-package reports
- [Version check](https://www.openadvisories.org/check), [lockfile scan](https://www.openadvisories.org/scan), [server scan](https://www.openadvisories.org/scan/server): browser versions of the API checks

## Feeds

- [All new vulnerabilities](https://www.openadvisories.org/feed.xml): Atom 1.0, latest 40 entries
- Any list has a feed: append `/feed.xml` to its URL (e.g. https://www.openadvisories.org/critical/feed.xml, https://www.openadvisories.org/vendor/microsoft/feed.xml)
- [Weekly digest feed](https://www.openadvisories.org/weekly/feed.xml)

## Documentation

- [Guide](https://www.openadvisories.org/guide): how to use the site, CI snippets, cron examples
- [Methodology](https://www.openadvisories.org/methodology): how records are merged, scored and matched to versions
- [Data sources](https://www.openadvisories.org/sources): every source, its license and live update status
- [About](https://www.openadvisories.org/about)

## Optional

- [Daily notifications](https://www.openadvisories.org/notifications): opt-in browser push, at most one per day, no e-mail or account
- [Terms of use](https://www.openadvisories.org/terms), [Privacy](https://www.openadvisories.org/privacy), [Legal notice](https://www.openadvisories.org/imprint), [Contact](https://www.openadvisories.org/contact)
- [Sitemap](https://www.openadvisories.org/sitemap.xml)