VulnerableCode

VulnerableCode is a free and open source database of vulnerable software packages. It helps answer two simple questions:

• Is Package Foo affected by a known vulnerability?

• If it is, which versions of Package Foo are affected, and which version fixes it?

It collects and correlates vulnerability information from upstream projects and trusted sources such as GHSA, Linux distributions, package repositories, the NVD and many others.

Modern software is built using hundreds of open source packages. Vulnerability data is the heart and soul of Software Composition Analysis (SCA), dependency management, SBOMs and software supply chain security. Good vulnerability data helps developers make better security decisions. Reliable and accurate vulnerable data becomes essential.

VulnerableCode follows a package-first approach. Using Package URLs (PURLs), it maps vulnerabilities directly to package versions across multiple ecosystems. It collects vulnerability information directly from upstream and ecosystem-specific sources, improves and correlates that data to produce accurate, transparent and traceable vulnerability information.

Open source software needs and deserves open vulnerability data. VulnerableCode helps developers, maintainers, and organisations make better security decisions while strengthening the security of the FOSS ecosystem.

Why reliable vulnerability data matters for open source software.

How VulnerableCode builds an open vulnerability database for FOSS packages.

How open vulnerability data strengthens software supply chain security.