Know every risk in your dependency tree.
OsVault scans your npm and PyPI packages against NVD, OSV.dev, EPSS, and CISA KEV — combining everything into one risk score so you fix what actually matters.
You don't know what's hiding
in your dependencies.
Undiscovered CVEs
New vulnerabilities are published daily across npm and PyPI. Without continuous monitoring, critical CVEs slip through unnoticed in your dependency tree.
Outdated Scoring
CVSS alone doesn't tell the full story. Without EPSS exploit probability and CISA KEV data, you're prioritizing the wrong vulnerabilities.
Scattered Sources
NVD, OSV.dev, EPSS, CISA KEV — critical intelligence is spread across dozens of sources. No single view of your actual risk posture.
Manual Triage
Security teams waste hours manually cross-referencing advisories. By the time a fix is prioritized, attackers have already moved.
All intelligence. One platform.
OsVault aggregates CVEs from NVD, advisories from OSV.dev, EPSS exploit scores, and CISA KEV data — computed into a unified risk score, updated daily.
Data Sources
Aggregate critical intelligence from dozens of fragmented origins.
OsVault Engine (Ingest-RS)
Unify, normalize, and violently accelerate threat-score mapping in real-time.
Output Ecology
Deliver deterministic intelligence directly into your workflow.
Track threats
as they emerge.
OsVault ingests vulnerabilities daily from NVD and OSV.dev, enriches them with EPSS exploit probability and CISA KEV membership, and computes a combined risk score — so you know exactly what to fix first.
Unified risk scoring
CVSS severity, EPSS exploit probability, and CISA KEV status combined into a single 0–100 score.
Multi-source intelligence
Pull from NVD, OSV.dev, FIRST EPSS, and CISA KEV — every critical source in one pipeline.
Daily ingestion
Automated Rust-based pipeline runs every 24 hours, ensuring you never miss a newly published CVE.
Context
beats severity.
A CVSS 9.8 that nobody exploits is less urgent than a CVSS 7.2 actively used in the wild. OsVault combines CVSS with EPSS exploit probability and CISA KEV data to give you actionable prioritization.
Every vulnerability is enriched with real-world exploit intelligence — not just theoretical severity. Stop chasing noise. Fix what matters.
Contextual accuracy vs. raw severity scoring
Your dependencies, secured.
Understands your ecosystem
Full support for npm and PyPI — the two largest open-source ecosystems. Every advisory tracked and enriched.
EPSS exploit probability
See how likely a vulnerability is to be exploited in the wild, based on real-world threat data from FIRST.
CISA KEV cross-reference
Instantly know if a CVE is in the CISA Known Exploited Vulnerabilities catalog — the gold standard for active threats.
GitHub PR security checks
Install the GitHub App and get automatic security check runs on every PR that touches your dependency files.
Instant dependency scan
Paste your package.json or requirements.txt to get a security grade, risk breakdown, and downloadable PDF report.
Combined risk scoring
Proprietary 0–100 score combining CVSS severity, EPSS probability, and KEV status into a single actionable metric.
Built for security engineers.
From automated ingestion pipelines to instant dependency scanning — built with the tools you trust.
Recent Critical & High CVEs
Updated daily at 5 AM UTCStart scanning today.
Install the GitHub App to automatically scan every PR, or paste your dependency file for an instant report — completely free.
Frequently asked questions.
OsVault aggregates data from the National Vulnerability Database (NVD) for CVE details and CVSS scores, OSV.dev for npm and PyPI advisories, FIRST EPSS for exploit probability scores, and the CISA Known Exploited Vulnerabilities (KEV) catalog.
Our Rust-based ingestion pipeline runs daily via CI, fetching the last 24 hours of CVEs from NVD and OSV advisories. Each record is enriched with EPSS scores and CISA KEV membership in real-time.
It's a proprietary 0–100 score that combines CVSS severity, EPSS exploit probability, and CISA KEV status into a single actionable metric. A high EPSS score or KEV membership significantly boosts the combined score.
Yes. The CVE browser, dependency scanner, and security grading are completely free to use. The GitHub App offers 10 free PR checks per month for private repositories.
Currently, OsVault supports npm (Node.js/JavaScript) and PyPI (Python) — the two largest open-source package ecosystems. More ecosystems are planned for future releases.