Vulnerability database
Every open source vulnerability, with the fix
Affected and fixed versions per ecosystem, severity, exploit prediction and known exploitation, updated every hour.
Search covers the advisories we keep: the packages MergeHarbor customers use, the most-used packages of each ecosystem and every known-exploited CVE. Any other CVE, GHSA or OSV id still opens: go to /vulnerabilities/advisories/<id> and we fetch it from OSV.dev.
Recently published
Find these in your repositories
MergeHarbor checks every repository's dependencies, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.