A vulnerability database stores records about known flaws, such as affected packages, versions and fixes. A scanner reads your code, lockfiles or images, builds a list of what you use and checks that list against one or more databases. The database is the knowledge. The scanner is the matcher.
Definitions
Vulnerability database. A collection of advisories. Each record typically names a flaw, the affected software, the version range and a fixed version when one exists. Examples of format and curation are documented by the GitHub Advisory Database and OSV.dev.
Scanner. A program that finds what software you have and compares it against advisory data. It may also check licenses, configuration or running behaviour, depending on type.
Aggregator. A service that combines several databases into one stream. OSV.dev describes itself this way, listing many source databases in a shared format and offering bulk downloads.
How they work together
- The scanner reads your manifests and lockfiles and lists packages and versions.
- It fetches advisory data, either live or from a downloaded copy.
- It matches each package and version against affected ranges.
- It reports matches, often with severity and fix information.
If you change either half, results change. A better matcher with old data misses things. Fresh data with a weak matcher raises false alarms.
Why this matters when you evaluate open source tools
| Question | About the database | About the scanner |
|---|---|---|
| Is a new advisory present? | Yes | No |
| Is the version range correct? | Yes | Partly |
| Did it find my transitive dependency? | No | Yes |
| Does it parse my lockfile format? | No | Yes |
| Does it explain how to fix? | Sometimes | Often |
| Can it say the code path is reachable? | No | Some tools |
When two scanners disagree, work out which half differs. Same data and different results points to matching. Different data and the same matcher points to coverage. Our post on why two scanners report different counts walks through it.
The data feed has its own maintenance needs
A project can look healthy while its data lags, or the other way round. Check the code and the feed as two separate things: when was the last release, and how fresh are the records it uses? You can test whether a scanner's advisory data is fresh with a known recent advisory.
What neither one tells you
Neither a database nor a scanner tells you whether a flaw matters in your system. A match says a vulnerable version is present. Whether the vulnerable function is called, exposed and exploitable is a further question. That is where reachability analysis comes in, and Safeguard's platform provides it alongside SBOM and dependency scanning. You can try the free scan at https://gold.safeguard.sh/scan.
Quick check
Can I use a vulnerability database without a scanner?
Yes, for lookups by package and version, but you must produce the inventory yourself. A scanner automates that.
Is the NVD a scanner?
No. It is a database of records. Scanners read it, along with other sources.
Sources
- GitHub, Advisory Database README
- OSV.dev, Data sources
Last reviewed: 19 October 2026.
