Project
Open-source vulnerability database and API run by Google that aggregates advisories across ecosystems in a standard schema, queryable by package and version.
Munim, Inc.'s census of 30 self-hosted AI projects found 195 of 618 maintainer advisories missing from GitHub's global database under their own IDs. Dependabot and pip-audit read that database. The author infers OSV tools share the gap, and his direct OSV sweep is still running.
Reality
Two of n8n's three September advisory batches, at least 26 advisories in all, have no CVE IDs, a dev.to post reports. A green scanner report on a self-hosted instance says little until someone checks the version by hand.
Reality
vLLM published more than 30 security advisories on GitHub between 12 September and 9 October, most without a CVE ID, a dev.to author reports. The author's five OSV.dev lookups came back empty, so a clean scanner run says little about any server below 0.31.0.
Reality
Homebrew rated the unsigned cask removal metadata path High and closed it back in 6.0.12. The 7.0.0 upgrade adds one Moderate sandbox escape through LaunchServices, plus a scanner for installed formulae.
Reality
Version 7.0.0 adds a brew vulns command that checks installed packages against OSV.dev and Homebrew's own advisory records. The same release drops Intel macOS 11 and later to Tier 3 and stops building bottles for it.
Reality
A developer spent a week on an agent that bumps vulnerable dependencies and repairs the breakage, and the repairs were the easy part; his log of how each failure reported success while being wrong is the useful artifact.
Reality