Package vulnerability intelligence
Check the version you actually run
Review package metadata, published advisories, exact-version matches, fixes, and CISA known-exploitation evidence across five open-source ecosystems.
Supported registries
Five ecosystems, one evidence model
Each page keeps registry facts, OSV package matches, CISA evidence, and severity separate.
Reading a result
Evidence in the order you need it
1
Exact version
OSV checks the package and version supplied by its registry.
2
Known exploitation
An exact CVE match identifies records listed in CISA KEV.
3
Severity and fixes
CVSS, affected ranges, and fixed versions retain their source context.
CISA catalog
Recently added vulnerabilities
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPD
CVE-2015-5477ISC BIND Data Processing Errors Vulnerability
ISC · BIND
CVE-2016-3081Apache Struts Command Injection Vulnerability
Apache · Struts
CVE-2021-3199ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · Docs
CVE-2023-22894Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi · Strapi
CVE-2026-88779Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScaler
Sources: package registries, OSV, and the CISA Known Exploited Vulnerabilities Catalog. Missing advisories do not establish that a package or version has no vulnerabilities.