vulndb
[mirror] The Go Vulnerability Database (by golang)
advisory-database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software. (by github)
vulndb | advisory-database | |
---|---|---|
3 | 10 | |
538 | 1,617 | |
0.0% | 1.4% | |
9.7 | 10.0 | |
6 days ago | about 18 hours ago | |
Go | ||
GNU General Public License v3.0 or later | Creative Commons Attribution 4.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
vulndb
Posts with mentions or reviews of vulndb.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2021-07-22.
-
GitHub brings supply chain security features to the Go community
With "Go vulnerability database", do you mean https://github.com/golang/vulndb?
-
What is the equivalent of "npm audit" in go?
An official vulnerability database for exactly that is in the making: https://go.googlesource.com/proposal/+/master/design/draft-vulndb.md https://github.com/golang/vulndb
-
Google's unified vulnerability schema for open source supports Rust on launch
Today, we’re excited to announce a new milestone in expanding OSV to several key open-source ecosystems: Go, Rust, Python, and DWF.
advisory-database
Posts with mentions or reviews of advisory-database.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-04-12.
- Request GitHub to build an advisory database for C / C++ packages · Issue #2963 · github/advisory-database
- Extend GitHub's CNA scope to manage CVEs for projects on GitHub
-
A CVE has been issued for hyper. Denial of Service possible
That has since been updated to Moderate: https://github.com/github/advisory-database/commit/aa9e5d5386c5610944edf2b0ee0e4301aabaf1c5
-
CVE-2022-23529 – node-jsonwebtoken
I am trying this on GitHub https://github.com/github/advisory-database/pull/1595
- CVE-2022-23529 - jsonwebtoken has insecure input validation in jwt.verify function - used by over 22,000 projects and downloaded over 36 million times per month on NPM - Exploiting the flaw could enable attackers to bypass authentication mechanisms, access confidential information etc.
-
GitHub’s database of security advisories is now open source
We already have fixed versions (where they exist) - example link below.
On backfilling the data to include advisories from before 2017 - absolutely. So far we've done this in a relatively ad-hoc way - you should already find that the most important (severe and wide-reaching) CVEs from before 2017 are in the database (and if there are any that aren't you think should be we'd love you to open an issue on the DB). We want to do a more complete backfill in the near future.
https://github.com/github/advisory-database/blob/main/adviso...
- GitHub's database of known vulnerabilities is now open source
- Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software
What are some alternatives?
When comparing vulndb and advisory-database you can also consider the following projects:
nancy - A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index
h2 - HTTP 2.0 client & server implementation for Rust.
rustsec - RustSec API & Tooling
elixir-security-advisories - Public database of Elixir security advisories