GitHub Advisory Database

https://github.com/advisories

GitHub-maintained advisory database, high-volume, machine-readable open-source ecosystem advisories (added 2026-05-08). 2026-05-08 audit: WebFetch returned 5 advisories all 2026-05-07 (rust-openssl, utcp-http, netbox, etc.). For per-ecosystem filtering use /advisories?type=...&query=...; for GraphQL / API see https://docs.github.com/en/graphql/reference/objects#securityadvisory. Candidate; promote to active after 3 runs. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → webfetch https://github.com/advisories (listing, dated GHSA items) then webfetch https://github.com/advisories/<GHSA-ID> for affected packages/CVE/severity/CWE. AVOID: Nothing to avoid for browsing; for programmatic/per-ecosystem filtering use /advisories?type=...&query=... or the GraphQL securityAdvisory API.. | 2026-07-05 root-cause + recipe fix: the 403 is NOT a browser-UA / anti-bot refusal, github.com AND api.github.com are blocked by the agent egress proxy itself (each session is bound to its configured repository; every other github.com path returns HTTP 403 with body `sessions are bound to their configured repositories`). No UA / header / Sec-CH-UA set recovers it (re-confirmed across chrome/firefox/googlebot/curl/minimal), and it behaves identically in the routine container. FETCH → bridge (OSV.dev, the reachable full mirror of the GitHub Advisory Database, every GHSA id, aliased to its CVE): `python3 tools/fetch_source.py osv query <ecosystem> <package> [version]` for advisories affecting a watchlist package (ecosystem ∈ npm|PyPI|Go|Maven|crates.io|NuGet|RubyGems|Packagist…), and `python3 tools/fetch_source.py osv vuln <GHSA-or-CVE>` to drill one advisory. fetch_method flipped webfetch→bridge; github.com/advisories stays the human citation URL. | 2026-07-05 admiralty audit: B, curated/reviewed advisory DB, canonical for GHSA namespace + some original research (mixed with CVE mirror); live, keep active. | 2026-08-10: RECIPE FINDING (B1, Wazuh cluster): a GHSA page's markdown render DROPS the sidebar metadata panel that carries the CVE ID, severity, affected/patched versions and credits, `fetch_source.py jina <url> html` surfaces it, `fetch_source.py url <url>` does not. Use the html variant whenever a GHSA page is the per-CVE authority for an id. Also note github.com/advisories/<id> (the global database) and osv.dev may 404 for days after a repo-scoped advisory publishes, so absence there is propagation lag, not a wrong id. | 2026-08-18: RECIPE FINDING (main-agent deep read): `fetch_source.py url` on a GHSA page routes through the reader and therefore fails outright while the pool is exhausted, whereas WebFetch reads the same page directly and returns the severity band, CVSS vector, affected/patched ranges and credits. With the reader down, WebFetch is the working transport for this source, not the bridge; this is how the GeoServer advisory severity was resolved this run. | 2026-10-02 (2026-10-02T0404Z-intel): github.com and api.github.com read fine again (supersedes the 2026-07-05 blocked note): `python3 tools/fetch_source.py url "https://api.github.com/repos/<org>/<repo>/security-advisories?per_page=100"` and `.../releases?per_page=30` return JSON with affected and patched ranges, and `extract` reads github.com release, pull-request and GHSA pages. | 2026-10-06 (S1, not re-verified by the main agent): `url "https://api.github.com/advisories?per_page=100&severity=critical&type=reviewed&sort=published&direction=desc"` returns the newest critical reviewed advisories as JSON in one call. | 2026-10-30 (2026-10-30T0255Z-intel, S1): the /advisories API path returns an empty body on the bridge and `gh api` is refused (403); working recipe: `extract 'https://github.com/advisories?query=severity%3Acritical+type%3Areviewed'`.