# Vulnerability database

> Look up any open source vulnerability by CVE, advisory id or package name, with affected and fixed versions, severity, exploit prediction, known exploitation and upgrade commands.

The vulnerability database is public and free: search it on the website at [/vulnerabilities](https://mergeharbor.com/vulnerabilities), or in the console under **Vulnerabilities → Advisories** (every plan), which each finding also links to.

## Search

Search by:

- a CVE id (`CVE-2021-44228`) or another advisory id (`GHSA-jfh8-c2jp-5v3q`, `GO-2022-0969`, `PYSEC-2021-19`); any id of an advisory leads to the same page;
- a package name (`log4j-core`, `lodash`);
- words from the description (`prototype pollution`).

Narrow results by ecosystem, or browse the recently published, known exploited, and most-likely-to-be-exploited lists.

## What the database keeps

The database keeps advisories for the packages MergeHarbor customers use, the 50 most-affected packages of each ecosystem (npm, PyPI, Go, Maven, NuGet, crates.io, RubyGems, Packagist, Pub and Hex), and every CVE in CISA's Known Exploited Vulnerabilities catalog. Search and the lists cover these.

Any other advisory still has a page: open `/vulnerabilities/advisories/<id>` with a CVE, GHSA or OSV id and MergeHarbor reads that advisory from OSV.dev by its id, shows it, and keeps it for a few hours. Only the advisory id is sent, never the names of your packages. An id OSV.dev doesn't know shows "Not found". A package page for a package the database doesn't track yet says so and links to OSV.dev's search.

Findings in your organization never depend on this: when a repository adds a package, its advisories are fetched within minutes, whether or not the package is in the public set.

## Advisory pages

Each advisory page shows:

- severity, the CVSS vector with each metric explained, and the EPSS score with its percentile;
- whether it is known to be exploited, with CISA's required action and due date;
- every affected package, per ecosystem, with affected version ranges and fixed versions;
- upgrade commands for the package manager (npm, Yarn, pnpm, pip, Poetry, uv, Go, Cargo, Bundler, Composer, Maven, Gradle, .NET and others);
- the weakness (CWE) with how to prevent it, and credits;
- references grouped by type: advisories, fixes and patches, exploits and evidence, issue reports, write-ups and packages;
- a timeline: published, added to CISA's catalog, the federal due date, the latest EPSS score, last updated, and withdrawn;
- related advisories: the ones its sources link, others affecting the same packages, and recent ones with the same weakness;
- where the information comes from.

Package pages list every advisory affecting a package, its latest version, license and OpenSSF Scorecard.

## Sources

The database combines OSV.dev, the GitHub Advisory Database, the National Vulnerability Database, CISA's Known Exploited Vulnerabilities catalog, FIRST's EPSS scores, MITRE's CWE list, the SPDX License List, Open Source Insights and endoflife.date. Every page credits the sources it uses. This product uses data from the NVD API but is not endorsed or certified by the NVD.

To check your own repositories against it continuously, see [vulnerability management](https://mergeharbor.com/docs/vulnerability-management).