ghsa

The goal of this project is to provide additional features on top of the existing npm audit options

EZGHSA is a command-line tool for summarizing and filtering vulnerability alerts on Github repositories.

23-tool MCP server for CVE & vulnerability intelligence. NVD, EPSS, CISA KEV, GitHub Advisory, OSV — unified in one server. Risk scoring, bulk triage, exploit search. 2 dependencies, runs with npx.

A tool to audit Hex dependencies, to make sure your ✨ gleam projects really sparkle!

A collection of packages for using security advisories from osv.dev in Node.js.

Public Codespaces runner for verified CVE/GHSA vulnerability reproductions

Self-hosted Grafana dashboard for GitHub Security Advisories. Postgres-backed, mirrors the GitHub API 1:1.

Lightweight, dependency-free shell script that scans 12 ecosystems (npm, PyPI, Go, Rust, Maven/Gradle, NuGet, RubyGems, Composer, Pub, Hex, Swift, GitHub Actions) for vulnerable dependencies using OSV & GHSA feeds — or your own JSON / CSV / PURL / SBOM / SARIF / Trivy sources

Security Knowledge Graph Triples

Claude Code skill for auditing web apps for security vulnerabilities. Detects inside-codebase vs outside-black-box, runs the right checklist, sweeps server/infra, deep-dives rate-limit posture. 14 PoC probe templates + deep ripgrep recipes.

A practical, consult-as-you-go guide for open source maintainers handling GitHub security advisories. Triage, private forks, CVEs, publication, and the gotchas nobody warns you about.

Attributed fork: explore OSV advisory records, provenance & review capacity with transparent lessons that preserve the upstream database.

GHSA-j425-whc4-4jgc: OpenClaw system.run Env Override Filtering Allowed Dangerous Helper-Command Pivots (CVSS 6.3)

Broken Object Level Authorization (BOLA) enables cross-user document viewing, modification, and unauthorized deletion via direct object reference.

Broken Object Level Authorization (BOLA) combined with credentialed CORS misconfiguration enables cross-user, cross-origin authenticated document exfiltration.

CVE-2026-33693: SSRF via 0.0.0.0 Bypass in activitypub-federation-rust v4_is_invalid() (CVSS 6.5 Moderate)

CLI tool that scans pnpm overrides and determines whether CVE-related overrides can be safely removed by running pnpm audit

Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)

CVE-2026-50131 / GHSA-xw9q-2mv6-9fr8: Fedify incomplete SSRF mitigation advisory landing page

Upstream Security Remediation for GHSA-6hh9-gpj4-cr69 (Merged Fix PR #168 in master: Missing IDX_DS_ADAPTIVE_TRIGGERS Sentinel in packetTypesGen3..7 in src/ControlStream.c, CWE-125/CWE-908)