vulnerability-db

(★ 146)

Vulnerability database and package search for sources such as Linux, OSV, NVD, GitHub and npm. Powered by sqlite, CVE 5.2, purl, and vers.

File Explorer

Download Latest Version (.zip)

- - pythonapp.yml
  - pythonpublish.yml
  - report_vdb_metadata.py
  - sanity_check_vdb.py
  - seed_cli_fixture_db.py
- FUNDING.yml
- - .gitignore
  - index.js
  - package.json
  - pnpm-lock.yaml
  - pnpm-workspace.yaml
  - README.md
- - deno.json
  - deno.lock
  - main.ts
  - README.md
- bench.md
- bench.py
- bench_baseline.json
- bench_search.py
- cpe_research.py
- match_set.md
- match_set.py
- Picture1.png
- Picture2.png
- Picture3.png
- Picture4.png
- Picture5.png
- Picture6.png
- pin_exposure.py
- reachability_audit.py
- reporting.md
- shard_split.md
- shard_store.md
- vdb_size_report.py
- vers_diff_harness.py
- - adp-tags.json
  - cna-tags.json
  - reference-tags.json
- CVE_Record_Format.json
- README.md
- BENCHMARKS.md
- - .dockerignore
  - .gitignore
  - Dockerfile
  - pyproject.toml
  - README.md
  - uv.lock
- - ALAS2022-2022-207.json
  - ALSA-2022-8580.json
  - aqua-alpine-edge.json
  - aqua-alpine-unfixed.json
  - AVG-999.json
  - CVE-2015-3192.json
  - CVE-2018-9840.json
  - CVE-2021-27434.json
  - CVE-2021-3618-na.json
  - CVE-2021-3618.json
  - CVE-2023-52426.json
  - CVE-2024-0057.json
  - CVE-2024-21312.json
  - CVE-2024-23771.json
  - CVE-2024-25450.json
  - CVE-2024-3801.json
  - cve_data.json
  - cve_wconfig_data.json
  - gha_data.json
  - gha_prob.json
  - GHSA-vc2p-r46x-m3vx.json
  - GHSA-xrjj-mj9h-534m.json
  - GO-2022-0251.json
  - GO-2022-0646.json
  - MAL-2024-1333.json
  - MAL-2024-1396.json
  - MAL-2025-6022.json
  - npm_adv_data.json
  - npm_data.json
  - nvd-CVE-2026-59890.json
  - openSUSE-SU-2022-2801-1.json
  - os_scan_purls.json
  - osv-almalinux-channels.json
  - osv-alpine-324-only.json
  - osv-alpine-fix.json
  - osv-azurelinux-fix-al2.json
  - osv-azurelinux-fix.json
  - osv-azurelinux-last-affected.json
  - osv-bellsoft-alpaquita.json
  - osv-bellsoft-hardened.json
  - osv-cve-2026-59890.json
  - osv-cve-test-npm-org.json
  - osv-debian-curl-trixie.json
  - osv-debian-dsa.json
  - osv-debian-fixed.json
  - osv-debian-nopkg.json
  - osv-debian-patch-trixie.json
  - osv-debian-unfixed.json
  - osv-debian-withdrawn.json
  - osv-ghsa-cvss4-mistyped-v3.json
  - osv-ghsa-cvss4-trailing-slash.json
  - osv-git.json
  - osv-mageia-single.json
  - osv-maven-cvss4.json
  - osv-maven-single.json
  - osv-npm-star-bug.json
  - osv-opensuse-single.json
  - osv-opensuse-su-2024-12257-1.json
  - osv-opensuse-tumbleweed-bash.json
  - osv-opensuse-withdrawn.json
  - osv-pypi-django.json
  - osv-pypi-ujson-bug.json
  - osv-pypi.json
  - osv-pypi2.json
  - osv-pypi4.json
  - osv-redhat-channels.json
  - osv-redhat-module.json
  - osv-redhat-multi.json
  - osv-redhat-nonrhel.json
  - osv-redhat-rhba.json
  - osv-redhat-single.json
  - osv-redhat-withdrawn.json
  - osv-rocky-single.json
  - osv-suse-bcl.json
  - osv-suse-livepatch.json
  - osv-suse-multi.json
  - osv-suse-nocve.json
  - osv-suse-overlap.json
  - osv-suse-single.json
  - osv-suse-umbrella.json
  - osv-ubuntu-cve-2025-46336.json
  - osv-ubuntu-fixed.json
  - osv-ubuntu-lsn.json
  - osv-ubuntu-unfixed.json
  - osv-ubuntu-usn.json
  - osv-ubuntu-withdrawn.json
  - osv_mixed_data.json
  - osv_multi_events.json
  - osv_mvn_data.json
  - osv_rust_data.json
  - osv_swift_data.json
  - osv_swift_data2.json
  - protobuf-c-unfixed.json
  - protobuf-c.json
  - redis.json
  - RLSA-2022-7730.json
  - RUSTSEC-2024-0343.json
  - SUSE-SU-2015-0439-1.json
  - SUSE-SU-2022-4192-1.json
- __init__.py
- deterministic_hash_probe.py
- QUERIES.md
- test_aqua.py
- test_aqua_cache.py
- test_blob_merge.py
- test_cli.py
- test_cpe.py
- test_custom_source.py
- test_db.py
- test_db_cmd.py
- test_db_size.py
- test_deterministic_hashes.py
- test_match_set.py
- test_npm.py
- test_osv.py
- test_osv_bellsoft.py
- test_pin_exposure.py
- test_reachability.py
- test_search_advanced.py
- test_search_bulk.py
- test_shard.py
- test_shard_store.py
- test_source.py
- test_utils.py
- test_vers.py
- - __init__.py
  - aqua.py
  - cna.py
  - config.py
  - cpe.py
  - custom.py
  - cve.py
  - db.py
  - db_cmd.py
  - display.py
  - gha.py
  - npm.py
  - nvd.py
  - orasclient.py
  - osv.py
  - search.py
  - search_index.py
  - shard_split.py
  - shard_store.py
  - utils.py
- __init__.py
- cli.py
.dockerignore
.flake8
.gitignore
AGENTS.md
conftest.py
INTEGRATION.md
LICENSE
MIGRATING_TO_V7.md
pyproject.toml
README.md
SECURITY.md
SKILL.md
THREAT_MODEL.md
uv.lock

# Installation Guide

1. Get the code

git clone https://github.com/AppThreat/vulnerability-db

Downloads the entire project code from GitHub to your computer.

cd vulnerability-db

Moves into the project folder you just downloaded.

2. Official Install Script

Easy Recommended

Prerequisites

Python 3 Python is required to use pip.

pip install appthreat-vulnerability-db>=7.0.0

Installs the package published on PyPI directly — no need to clone the source.

pip install appthreat-vulnerability-db[all]

Installs the package published on PyPI directly — no need to clone the source.

pip install appthreat-vulnerability-db==5.8.0

Installs the package published on PyPI directly — no need to clone the source.

pip install -U "huggingface_hub[cli]"

Installs the package published on PyPI directly — no need to clone the source.

✅ After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.

Pulled directly from this repo's README.

3. Docker

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Docker Desktop Needed to build and run containers. Install it and keep it running in the background.

⚠️ This is a large repository, so this method may point to an internal sub-package rather than the actual core product. Check the full README as well.

docker build -f packages/mcp-server-vdb/Dockerfile -t vulnerability-db .

Builds a runnable image based on the Dockerfile.

docker run -p 8080:80 vulnerability-db

Runs the built image as an actual container.

✅ Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.

4. Node.js

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Node.js Node.js must be installed to use npm. The LTS version is recommended.

vdb db refresh npm pypi # named shards (shard names or purl types; nuget resolves to app)

Type this command into your terminal and run it.

ghcr.io/appthreat/vdb7-npm:v7.0.x-xz one purl type

Type this command into your terminal and run it.

hf download --repo-type dataset AppThreat/vdb v7-npm/data.vdb7 # raw .vdb7

Type this command into your terminal and run it.

vdb --search "cpe:2.3:a:npm:gitblame:*:*:*:*:*:*:*:*"

Type this command into your terminal and run it.

vdb --search "npm:gitblame:0.0.1" # colon-separated

Type this command into your terminal and run it.

✅ After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.

Pulled directly from this repo's README.

5. Python

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Python 3 On Windows, be sure to check 'Add Python to PATH' during installation.

pip install appthreat-vulnerability-db>=7.0.0

Installs the package published on PyPI directly — no need to clone the source.

pip install appthreat-vulnerability-db[all]

Installs the package published on PyPI directly — no need to clone the source.

pip install appthreat-vulnerability-db==5.8.0

Installs the package published on PyPI directly — no need to clone the source.

pip install -U "huggingface_hub[cli]"

Installs the package published on PyPI directly — no need to clone the source.

✅ If it runs without errors and prints output in the terminal, it worked.

Pulled directly from this repo's README.