https://github.com/anchore/vulnerability-data-tools
https://github.com/anchore/vulnerability-data-tools
Last synced: over 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/anchore/vulnerability-data-tools
- Owner: anchore
- License: apache-2.0
- Created: 2024-03-18T15:26:30.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2025-04-23T08:33:26.000Z (over 1 year ago)
- Last Synced: 2025-04-23T09:34:27.883Z (over 1 year ago)
- Language: Python
- Size: 46.9 MB
- Stars: 14
- Watchers: 14
- Forks: 3
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
# Vulnerability Data Tools
Welcome to the Vulnerability Data Tools project! We're building an open source ecosystem for enriching and maintaining high-quality vulnerability data.
## What is this project?
The security community relies on accurate vulnerability data to protect systems and users. This project provides tools and workflows to help maintain and improve that data, especially when upstream sources like NVD have gaps or inaccuracies.
The project consists of three main repositories that work together:
- **vulnerability-data-tools** (this repo): The core tools and scripts for processing vulnerability data
- **vulnerability-data**: The primary vulnerability data repository in a format that can generate multiple output formats
- **nvd-data-overrides**: Generated NVD-compatible data that enriches upstream vulnerability information
## Getting Started
Want to help improve vulnerability data? Here's how to begin:
1. Check out our [contribution guide](CONTRIBUTING.md) for detailed technical instructions
2. Join our [Anchore Community Discourse](https://anchore.com/discourse) to connect with the community
3. Browse current [issues](https://github.com/anchore/vulnerability-data-tools/issues) to find ways to help
## Community
We welcome contributors of all skill levels! Whether you're reporting issues, improving documentation, or adding new features, your help makes this project better.
Feel free to:
- Join discussions in our [Anchore Community Discourse](https://anchore.com/discourse)
- Open issues for bugs or suggestions
- Submit pull requests with improvements
- Help review pull requests
## FAQ
### Why create this project?
Software like Grype uses NVD data to identify vulnerabilities in artifacts not covered by other data sources. When NVD data has gaps or inaccuracies, we need a way to maintain and share corrections. Creating an open source project helps the whole community benefit from these improvements.
### What if NVD improves its data quality?
We'll continue maintaining this project even if NVD or similar services improve. Different vulnerability databases support different ecosystems, so having tools to enrich and cross-reference vulnerability data remains valuable. We see this project as complementary to existing vulnerability databases, helping to fill gaps and add value where needed.
### Why not use PURLs instead of CPEs?
The project currently uses CPEs to maintain compatibility with tools that expect NVD-format data. However, our underlying data format is designed to support multiple output formats, including PURL-based formats like OSV. The goal is to be flexible while maintaining compatibility with existing tools.
### How can I help?
You can help in many ways:
- Report data quality issues you find
- Help improve the documentation
- Submit corrections to vulnerability data
- Add support for new package ecosystems
- Review pull requests
- Join discussions and share ideas
### Shouldn't this be part of a foundation?
Possibly! However, our focus right now is on building useful tools and proving they work. Finding a long-term organizational home will come naturally once we've demonstrated value to the community.
## License
This project is licensed under the [Apache 2.0 License](LICENSE).