Recent content on OSV Blog
Live Last read · last published · next check
We’ve recently rolled out a series of major upgrades to the OSV.dev ingestion pipeline, including importing data from the CVE Program's CVEList directly. These changes focus on getting vulnerability data into OSV faster, improving record provenance, and dramatically reducing backend processing times. Best of all, these updated records are available now!
2025 has been an eventful year for OSV, marked by significant expansion, infrastructure improvements, and continued community growth across all our projects.
As more vulnerabilities are published to OSV.dev, we want to ensure our API remains fast and reliable for our users. To support this, we've rolled out a new database indexing strategy, resulting in API queries that are now up to 5x faster.
Linux distributions often maintain their own advisories to announce fixes based on source CVEs and operate security trackers to monitor unfixed vulnerabilities. For example, Debian and Ubuntu use Debian Security Advisories (DSAs) and Ubuntu Security Notices (USNs), respectively. This is necessary because Linux distributions apply and backport patches, which means the impact and required fixes for…
Today we’re excited to announce that the first beta of OSV-Scanner V2 is ready! The team has been hard at work in the past months to revamp OSV-Scanner under the hood (transitioning to OSV-Scalibr , which we announced earlier this month ) and building several new significant features. This beta release does not introduce any breaking CLI changes - existing OSV-Scanner can use the tool in exactly…
2024 has been an even more eventful year for OSV.
We're excited to announce that OSV.dev's API now allows you to query all our supported Linux distributions! From now on, any new Linux distribution adopting the OSV Schema will be instantly available for querying as soon as it's imported by OSV.dev!
OSV's mission is to enable developers to reduce security risk arising from known vulnerabilities in open source components they use. Part of the strategy to accomplish that mission is to provide a comprehensive, accurate and timely database of known vulnerabilities covering both language ecosystems and OS package distributions. Today, OSV.dev's coverage is fast approaching 30 ecosystems, while…
Chainguard has recently started publishing their security advisories in OSV , and these are now feeding into the OSV.dev database. This expands OSV.dev’s coverage of Linux distributions, by including security advisories for Wolfi .
We are excited to announce that OSV-Scanner now supports transitive dependency scanning for Maven pom.xml. This highly requested feature empowers you to detect vulnerabilities in both your direct and indirect dependencies in the Maven ecosystem, giving you a complete picture of your Maven-based project's known vulnerable dependencies. With this feature, OSV-Scanner fixes one out of two…