84 GHSAs reference CVE IDs with no record in cvelistV5, the CVE Services API, or NVD

首先审查经 GitHub 审核的 63 条公告，以及针对 cvelistV5、CVE Services API 和 NVD 的验证方法。确定仓库级公告是否在范围内，以及对于悬空别名预期采用何种处置或报告格式；完成的标准是确定一致同意的路由方式和一组可执行的记录。

Summary

While cross-referencing the GitHub Advisory Database against the CVE Program, I found 84 advisories whose aliases list a CVE ID that returns not found in all three authoritative sources I checked:

• CVEProject/cvelistV5 — no record
• the CVE Services API (cveawg.mitre.org) — CVE_RECORD_DNE
• NVD (services.nvd.nist.gov) — 0 results

Each advisory was itself published more than 120 days ago (GHSA published date), so this isn't fresh-sync lag.

I've split them by where they live, since that affects who can act on them:

• 63 are github-reviewed advisories in this database (github.com/advisories/...).
• 21 are repo-level advisories published in individual projects' repos (github.com/<owner>/<repo>/security/advisories/...) that are not in the reviewed database — included for completeness since they show the same dangling-CVE pattern; they may be out of scope here.

I'm not assuming fault or a specific cause — an alias could be a typo, the CVE may have been rejected or never finalized, or it could be a migration gap. I wanted to surface it rather than guess. Is this useful, and is there a preferred way to report or route these (per-advisory, grouped by CNA, raw JSON/CSV)? Happy to adapt the format to whatever is easiest to act on.

How this was verified

• Generated 2026-06-16T18:24:47Z; each CVE checked live against the three sources above.
• 84 absent from all three.

Github-reviewed advisories in this database (63)

Repo-level advisories not in the reviewed database (21)