How Advisories works
14,463 advisories for 277 projects and vendors so far, from OSV, the GitHub Advisory Database and what vendors publish themselves, checked every day at 07:15 UTC.
Vendor coverage
1,561 of 1,561 registry companies checked so far (100%), 132 with an official advisory source, 123 with advisories here. Each day the run checks a few more at their well-known paths (security.txt, CSAF provider metadata, a security advisories page and its feed) and rechecks each company every 30 days.
| Company | Sources | Advisories | Checked |
|---|---|---|---|
| CNAGitHub | 2,633 | Sep 26 | |
| CNAGitHub | 2,153 | Sep 26 | |
| CNAGitHub | 1,986 | Sep 26 | |
| CNAGitHub | 1,545 | Sep 26 | |
| CNAGitHub | 501 | Sep 26 | |
 AmazonCNAFeedGitHub | CNAFeedGitHub | 170 | Sep 26 |
| CNAGitHub | 162 | Sep 26 | |
| CNAGitHub | 153 | Sep 26 | |
| CNAGitHub | 152 | Sep 26 | |
| GitHub | 90 | Sep 26 | |
| GitHub | 82 | Sep 26 | |
| GitHubCNA | 41 | Sep 26 | |
| GitHub | 40 | Sep 26 | |
| GitHubCNA | 38 | Sep 26 | |
| GitHubCNA | 35 | Sep 26 | |
| GitHub | 33 | Sep 26 | |
| GitHub | 14 | Sep 26 | |
| CNAGitHub | 11 | Sep 26 | |
| CNAGitHub | 10 | Sep 26 | |
| CNAGitHub | 7 | Sep 26 | |
| GitHub | 5 | Sep 26 | |
| CNAGitHub | 4 | Sep 26 | |
| GitHub | 2 | Sep 26 | |
| GitHub | 1 | Sep 26 | |
| GitHub | 0 | Sep 26 | |
| GitHubCNA | 0 | Sep 26 | |
| GitHub | 0 | Sep 26 | |
| GitHubCNA | 0 | Sep 26 | |
| GitHub | 0 | Sep 26 | |
| GitHub | 0 | Sep 26 |
CNA: CVE records the company issues as a CVE Numbering Authority. Feed: its own advisory RSS or Atom feed. CSAF: its CSAF provider files. GitHub: security advisories in its public GitHub organization. A company with no source here publishes none of these in a form we can read, or has none yet.
Vendor sources read daily
158 so far, most advisories first.
Coverage and growth
The aim is every open-source data and AI project with an advisory. repos.fru.dev names 637 projects so far; 100% have been checked for packages (deps.dev) and advisories (OSV), and 155 of those are covered here. 241 projects and 623 advisories were added in the last 30 days, from 165 sources (+159 new).
- What is fru.dev Advisories?
- A daily list of security advisories and CVEs for the AI and data stack: inference servers (vLLM, Ollama, SGLang, LiteLLM), agent frameworks (LangChain, LlamaIndex, Langflow, n8n), ML frameworks (PyTorch, TensorFlow, Transformers), MLOps (MLflow, Ray) and the data platform (Airflow, Spark, Kafka, dbt, DuckDB). Each advisory shows its severity, CVSS score, the affected versions and the version that fixes it.
- Which projects does it cover, and how does the list grow?
- It started with about 70 hand-picked projects. Every day the run also reads the projects repos.fru.dev tracks (every notable open-source data and AI project), asks deps.dev which packages each one publishes (PyPI, npm, Maven, Go, crates.io, NuGet, RubyGems) and adds a project as soon as OSV holds an advisory for one of them. Projects added this way are marked Unverified until checked by hand. Every company in the companies.fru.dev registry is also checked for official advisory sources (security.txt, CSAF provider metadata, a security advisories page and its feed, CNA status), a slice each day, and the result is shown on the method page.
- Where does the data come from?
- Two kinds of source, read every day. Package advisories come from the OSV database (osv.dev), which carries the GitHub Advisory Database and the PyPA, Go and other ecosystem databases; duplicate records of the same issue (GHSA, PYSEC, GO ids) are folded into one, under the GitHub id. Vendor advisories come from what companies publish themselves: the CVE records a company issues as a CVE Numbering Authority (read from NVD), its own advisory feed (AWS security bulletins), its CSAF provider files and the security advisories in its public GitHub organization. A CVE listed from one source is not listed again from another. NVD fills in a score for records that have none.
- How is severity decided?
- Where GitHub reviewed an advisory, its severity label (critical, high, moderate, low) is used. The CVSS 3.x base score is computed from the advisory's vector with the FIRST formula. An advisory with only a CVSS 4.0 vector keeps GitHub's label. "Unrated" means no source has scored it yet.
- What should I patch first?
- The Patch now table on the home page lists critical and high advisories published in the last six weeks, worst first, with the fixed version. Upgrade the package to at least that version. An advisory with no fixed version has no patch yet: check the source advisory for a workaround.
- Does an advisory mean my deployment is vulnerable?
- Not necessarily. It means the listed versions of the package contain the issue. Whether you are exposed depends on the version you run and whether you use the affected feature. Check your installed version against the affected ranges on the advisory page.
- Is there an RSS feed?
- Yes. /rss.xml carries every new advisory, /severe.xml only critical and high ones, and each package has its own feed, for example /packages/vllm/rss.xml. A weekly email on Wednesdays lists the critical and high advisories, only in weeks that have some.
- Is this a security audit?
- No. It restates what OSV, GitHub and NVD publish, with a link to each source. Check the source advisory and the versions you actually run before you act. Something wrong or missing? Use Suggest a correction on any advisory; corrections are reviewed by hand.