How Advisories works
4,038 advisories for 70 AI and data projects, from OSV and the GitHub Advisory Database, checked every day at 07:15 UTC.
- What is fru.dev Advisories?
- A daily list of security advisories and CVEs for the AI and data stack: inference servers (vLLM, Ollama, SGLang, LiteLLM), agent frameworks (LangChain, LlamaIndex, Langflow, n8n), ML frameworks (PyTorch, TensorFlow, Transformers), MLOps (MLflow, Ray) and the data platform (Airflow, Spark, Kafka, dbt, DuckDB). Each advisory shows its severity, CVSS score, the affected versions and the version that fixes it.
- Where does the data come from?
- From the OSV database (osv.dev), which carries the GitHub Advisory Database and the PyPA, Go and other ecosystem databases, read every day. Duplicate records of the same issue (GHSA, PYSEC, GO ids) are folded into one, under the GitHub id. NVD fills in a score for the few records that have none.
- How is severity decided?
- Where GitHub reviewed an advisory, its severity label (critical, high, moderate, low) is used. The CVSS 3.x base score is computed from the advisory's vector with the FIRST formula. An advisory with only a CVSS 4.0 vector keeps GitHub's label. "Unrated" means no source has scored it yet.
- What should I patch first?
- The Patch now table on the home page lists critical and high advisories published in the last six weeks, worst first, with the fixed version. Upgrade the package to at least that version. An advisory with no fixed version has no patch yet: check the source advisory for a workaround.
- Does an advisory mean my deployment is vulnerable?
- Not necessarily. It means the listed versions of the package contain the issue. Whether you are exposed depends on the version you run and whether you use the affected feature. Check your installed version against the affected ranges on the advisory page.
- Is there an RSS feed?
- Yes. /rss.xml carries every new advisory, /severe.xml only critical and high ones, and each package has its own feed, for example /packages/vllm/rss.xml. A weekly email on Wednesdays lists the critical and high advisories, only in weeks that have some.
- Is this a security audit?
- No. It restates what OSV, GitHub and NVD publish, with a link to each source. Check the source advisory and the versions you actually run before you act. Something wrong or missing? Use Suggest a correction on any advisory; corrections are reviewed by hand.