Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

EUVD support in GHSA

Open
#7,285 0 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Quiet
Tech stack
github
Domain
security

Research direction

No files, tests, or entry points are named. Start by reviewing how the advisory database and Dependabot currently consume GHSA and CVE data, then examine the EUVD API and identifier requirements. Done would require a defined support scope and an agreed implementation plan, which this issue does not yet provide.

Written by the indexing model from the issue text.

Description

Hello,

Yesterday I have commented an old issue, but I think it is better to open a new one :) (https://github.com/github/advisory-database/issues/5745)

According to the CRA (Cyber Resilience Act) requirements, generating an SBOM — and therefore performing vulnerability scanning — will become mandatory by the end of the year (September 2026 at the time of writing). As far as I understand, Dependabot relies on the GHSA database to detect vulnerabilities.

It would be highly valuable for European developers if GitHub could also support the EUVD, since the CRA mandates the use of EUVD instead of CVE. GitHub + GHSA + Dependabot already form a strong native tooling stack for automated vulnerability scanning, without requiring external tools — most of which currently do not support EUVD either.

The commonly mentioned issue is that the EUVD API is not well documented and currently only exposes CVE-based entries, but the database is expected to be populated with EUVD identifiers once the CRA becomes applicable. So yes, today EUVD is a « copy » of CVE IDs but later EUVD IDs would be unique and not in the CVE database.

I’m commenting this ticket to ask for your thoughts regarding potential EUVD support.
Is this something you are considering, and if so, is it planned before September 2026?

Thanks in advance.

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 15h
Merged PRs (30d)
46

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.