# Open Source Vulnerability Schema

The Open Source Vulnerability (OSV) schema provides a human and machine readable data format to describe vulnerabilities in a way that precisely maps to open source package versions or commit hashes.

This format is currently exported by:
- [AlmaLinux](https://github.com/AlmaLinux/osv-database)
- [BellSoft Security Advisory](https://github.com/bell-sw/osv-database)
- [Bitnami Vulnerability Database](https://github.com/bitnami/vulndb)
- [Chainguard](https://packages.cgr.dev/chainguard/osv/all.json)
- [Curl](https://curl.se/docs/vuln.json)
- [Echo](https://advisory.echohq.com/osv/all.json)
- [GitHub Security Advisories](https://github.com/github/advisory-database)
- [Global Security Database](https://github.com/cloudsecurityalliance/gsd-database)
- [Go Vulnerability Database](https://github.com/golang/vulndb)
- [Haskell Security Advisories](https://github.com/haskell/security-advisories)
- [LoopBack Advisory Database](https://github.com/loopbackio/security/tree/main/advisories)
- [Malicious Packages Repository](https://github.com/ossf/malicious-packages)
- [Mageia Advisories](https://advisories.mageia.org/)
- [MinimOS](https://packages.mini.dev/advisories/osv/all.json)
- [openEuler](https://repo.openeuler.org/security/data)
- [OSS-Fuzz](https://github.com/google/oss-fuzz-vulns)
- [OSV.dev maintained converters](https://github.com/google/osv.dev#current-data-sources) (Debian, Alpine, NVD)
- [PyPI Advisory Database](https://github.com/pypa/advisory-database)
- [Python Software Foundation Database](https://github.com/psf/advisory-database)
- [RConsortium Advisory Database](https://github.com/RConsortium/r-advisory-database)
- [Red Hat](https://security.access.redhat.com/data)
- [Rocky Linux](https://distro-tools.rocky.page/apollo/openapi/#osv)
- [Rust Advisory Database](https://github.com/RustSec/advisory-db)
- [SUSE](https://www.suse.com/support/security/)
- [Ubuntu](https://github.com/canonical/ubuntu-security-notices/)
- [VMWare Photon OS](https://github.com/vmware/photon/wiki/Security-Advisories) (unofficial)

Together, these include vulnerabilities from:
-   AlmaLinux
-   Alpine
-   Alpaquita Linux
-   Android
-   BellSoft Hardened Containers
-   Bitnami
-   Chainguard
-   crates.io
-   Debian GNU/Linux
-   Echo
-   GitHub Actions
-   Go
-   Haskell
-   Hex
-   Linux kernel
-   Mageia
-   Maven
-   MinimOS
-   npm
-   NuGet
-   openEuler
-   openSUSE
-   OSS-Fuzz
-   Packagist
-   Photon OS
-   Pub
-   PyPI
-   Python
-   R (CRAN and Bioconductor)
-   Red Hat
-   SUSE
-   Rocky Linux
-   RubyGems
-   Ubuntu

These vulnerabilities are aggregated by <https://osv.dev>.

Join the discussion in the [OpenSSF Slack](https://slack.openssf.org/) channel [#osv_schema](https://openssf.slack.com/archives/C03K6SZBH2S)

Reference tooling (e.g. converters) can be found in the [tools/](tools) directory

The current version of the specification is rendered [here](https://ossf.github.io/osv-schema/).

The OSV-Schema specification and the tools here are maintained by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/) [Vulnerability Disclosures Working Group (WG)](https://github.com/ossf/wg-vulnerability-disclosures).
