OSV.dev aggregates two kinds of sources. Native sources publish in the OSV format themselves, including the GitHub, PyPI, Go and Rust advisory databases. Converted sources, which OSV.dev's pipeline transforms, are Debian Security Advisories, Alpine SecDB and NVD CVEs for open source software.
The source list
From the OSV data page, fetched 19 October 2026:
| Type | Sources |
|---|---|
| Native OSV format | GitHub Advisory Database, PyPI Advisory Database, Go Vulnerability Database, Rust Advisory Database, Drupal Advisory Database, Global Security Database, OSS-Fuzz, Rocky Linux, AlmaLinux, Haskell Security Advisories, RConsortium Advisory Database, OpenSSF Malicious Packages, Python Software Foundation Database, Bitnami Vulnerability Database, Ubuntu, opam, and the Erlang Ecosystem Foundation CNA |
| Converted by the pipeline | Debian Security Advisories, Alpine SecDB, NVD CVEs for open source software |
Why the split matters
A native source controls its own records, including ranges and aliases. A converted record is a translation. The OSV FAQ explains why OSV exists: CPEs are hard to match automatically to package names and versions. A conversion from CPE style data has to infer package and range, and inference can be wrong or broad.
So when two scanners disagree on a flaw in a language library, ask which source each used. A native ecosystem record with precise ranges and a converted record from a general feed can give different answers. For background see vulnerability tool advisory data sources.
Ecosystems covered
The same page lists covered ecosystems, including crates.io, Go, Maven, npm, NuGet, Packagist, PyPI, RubyGems, Hex, Pub, GitHub Actions, Debian, Alpine, Ubuntu, the Linux kernel and others. Coverage of a registry is only as good as the sources behind it. An ecosystem on the list can still lack advisories if no source publishes them.
How to use this in practice
- Take one dependency you care about.
- Search its name in OSV and note each record's ID prefix, which hints at the source.
- Check whether a native source record exists beside a converted one.
- Compare ranges. Prefer the record with explicit
fixedevents. - If a record is missing, the FAQ says to raise it with the home database that owns it. OSV may have rejected the import on quality grounds, and the not found page for that record says so.
Limits of this list
The list changes. New sources are added, and older ones can be removed. Treat any copy of it, including this one, as dated. Re-read the page before you rely on it in a vendor review or audit answer.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which ecosystems appear in the inventory, since each one depends on a different source set.
Safeguard SBOM and dependency scanning covers components across ecosystems, with reachability analysis on top. A free scan shows your own mix.
Quick check
Is a converted record less reliable?
Not always, but conversion involves inference. Check ranges against the vendor advisory.
What if OSV has no record for a known flaw?
It may have failed a quality check on import. The FAQ advises raising it with the database that owns the record.
Sources
Last reviewed: 19 October 2026.
