Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Add Sonatype OSS Index as data source for GHSA database

Open
#4,924 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
github
Domain
databases, security

Research direction

Compare the requested integration with issue #4843 and inspect how the advisory database currently uses NVD data. Determine where an OSS Index source would fit and define completion as incorporating its vulnerability reports without losing existing coverage.

Written by the indexing model from the issue text.

Description

Similiar to #4843 : Some CVEs are not reported to NVD or are added very late.
We previously used to scan for CVEs only using the NVD database, but a lot of our customers used the OSS index and fairly frequently reported some CVEs back to us that our scan failed to pick up due to it missing in the NVD database. Since then we have changed our CVE scans to use both databases and have not had that issue since.
Since we are now moving our projects to Github and would love to use Dependabot it would be great to not have that issue come back up again.

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 15h
Merged PRs (30d)
46

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Databases issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.