Microproduct data guideintermediate

OSV Open Source Vulnerabilities

Package- and commit-resolved open-source advisories for building dependency exposure monitors and remediation queues.

Start the guide Open official source

At a glance

Difficulty
Intermediate — some data preparation helps
Size
Medium · ≤1 GB
Formats
JSON
Access
API or Download
API key
Not required
Provider
Google OSV
Updates
Continuous
Data terms
Creative Commons Attribution 4.0 International

From source to product signal

Test a product idea in four steps

OSV.dev aggregates OpenSSF OSV-format advisories and matches them to package names, versions, and commits. Start by querying one pinned package version. A match is not the same as a CVE or CPE lookup in NVD, and it does not prove that your deployed code path is exploitable.

1

Check the setup

  • Python 3.10 or newer
  • A notebook environment such as Jupyter or Google Colab
  • An internet connection
2

Access the data

  1. 1.Open the OSV.dev API examples and choose one ecosystem, package name, and version.
  2. 2.POST a bounded query for that exact package version.
  3. 3.Record the package coordinates and retrieval timestamp before triaging aliases.
Open official source
3

Run the Python example

Install the packages, then run the notebook cell.

python -m pip install pandas requests

import pandas as pd
import requests

response = requests.post(
    "https://api.osv.dev/v1/query",
    json={
        "version": "2.4.1",
        "package": {"name": "jinja2", "ecosystem": "PyPI"},
    },
    timeout=30,
)
response.raise_for_status()
advisories = pd.DataFrame(response.json().get("vulns", []))
advisories["retrieved_at_utc"] = pd.Timestamp.now(tz="UTC")
print(advisories[["id", "summary", "published"]].head(20))
4

Test a useful signal

Check one pinned Python package for known advisories

List OSV advisories that match a specific PyPI package version and note their aliases.

  1. 01Confirm the query returned vulnerability IDs for the pinned package version.
  2. 02Expand aliases such as CVE or GHSA identifiers and record whether a fix version is listed.
  3. 03Explain that package-resolved OSV matches are not a substitute for NVD CPE search or proof of exploitability in your application.

Dataset details

Google OSV is a company source. Last verified 2026-08-14. Temporal coverage: continuously updated advisories from participating ecosystems.

Theme

Technology & Cybersecurity

Domains

CybersecuritySoftware SecurityOpen Source

Data types

Event DataKnowledge Graph

Tasks

Vulnerability MonitoringAlertingCoverage Analysis

Geography

Global

Formats

JSON

Provider

Google OSV

Data terms

Creative Commons Attribution 4.0 International