Data Sources

Vulnpatch aggregates security data from multiple authoritative sources to provide comprehensive vulnerability information. Each source is relayed under its own terms, stated source by source on the data terms page together with Vulnpatch's own licence (CC BY 4.0) and the citation format. An incorrect record goes through data corrections.

Primary Sources

nixpkgs security issues

The primary nixpkgs source is the set of GitHub issues in NixOS/nixpkgs labelled 1.severity: security, open and closed. Most are filed automatically for CVEs that match a Nix package; some are filed by people. Vulnpatch reads them by label, so issues from any author are included.

The NixOS security review also supplies automatic suggestions and their accepted, published, or rejected decisions. A rejected suggestion may contain many proposed attributes; rejecting it does not mean every listed attribute was separately inspected. Vulnpatch also derives package-name candidates from Repology and the nixpkgs search index. Those are discovery leads, not confirmed affected packages. The dossier's nixpkgs.candidates[].identity records whether project identity was corroborated or the result is only a name match. See the dossier's security review fields.

Data provided:

• CVE identifiers
• Affected packages
• Severity levels (critical, high, medium, low)
• Fix availability status
• Assignment status

Why nixpkgs?

OSV.dev covers dozens of ecosystems but has no Nix or nixpkgs ecosystem of its own, so the generic machinery this site uses for npm, PyPI, Debian and the rest has nothing to query for nixpkgs packages. Nixpkgs also tracks its own vulnerabilities differently: through labelled GitHub issues and a security review that accepts, publishes or rejects a proposed package match, not a single upstream advisory feed. Reading that process takes a dedicated pipeline, not a request to OSV with a different ecosystem name.

That pipeline is also worth building because of nixpkgs's own scale: over 140,000 packages, more than a million commits and roughly half a million closed pull requests on GitHub, from thousands of contributors.

Two features exist because of this. Vulnpatch builds and publishes its own OSV-format feed for nixpkgs, since none exists upstream. The Ahead panel follows a CVE from the moment it maps to a nixpkgs package, through the security issue nixpkgs files and the pull request that closes it. nixpkgs also appears as one of several sources on Signal, which tracks freshness across every source this database reads, and SBOMs with nixpkgs-mapped packages work the same as any other through Time Travel.

NixOS Discourse security advisories

The Ahead panel only ever starts from a CVE record, so it cannot be earlier than the CVE itself exists. The dedicated, low-volume NixOS Discourse Security category is where the NixOS security team posts coordinated-disclosure advisories, sometimes well before a CVE is formally assigned. Vulnpatch polls this category every five minutes and surfaces each post on Nix security signal and /api/v1/nix/discourse-security independent of whether a CVE exists yet. A post is linked to a CVE's own dossier only when the CVE id is directly named in the post text; see the endpoint's docs for what is and is not correlated.

Data provided:

• Advisory title, URL and Discourse's own disclosure timestamp
• A first-pass keyword match of named projects (Nix, Lix)
• A directly-mentioned CVE id, when the post names one

OSV.dev

OSV (Open Source Vulnerabilities) is Google's distributed vulnerability database for open source software.

Data provided:

• Vulnerability details across 38+ ecosystems
• Affected version ranges
• References and advisories
• Severity scores

Repology

Repology tracks package versions across hundreds of repositories.

Data provided:

• Current package versions
• Version history
• Cross-repository comparisons
• Upstream release information

Secondary Sources

CVE Database

The CVE Project provides the authoritative CVE identifier assignments.

GitHub Advisories

GitHub Security Advisories provides vulnerability information for packages hosted on GitHub.

NVD (National Vulnerability Database)

NVD provides additional analysis and CVSS scores for CVEs.

CISA KEV

The Known Exploited Vulnerabilities catalog confirms a CVE is being actively exploited.

FIRST EPSS

The Exploit Prediction Scoring System estimates the probability a CVE will be exploited in the near term.

ENISA EUVD

The EU Vulnerability Database provides an additional, European-sourced vulnerability record for cross-reference.

Data Freshness

Source	Update Frequency
nixpkgs security issues	Changed issues every 30 minutes; a full re-read daily
OSV.dev	Hourly
Repology	Hourly
NVD	Daily

Data Quality

Vulnpatch applies several quality measures:

1. Deduplication: CVEs appearing in multiple sources are merged
2. Severity normalization: CVSS scores are normalized to critical/high/medium/low
3. Version matching: Affected versions are validated against Repology data
4. Confidence scoring: Matches include confidence levels based on data quality

Terms and corrections

Every source above is relayed under its own terms, and the API carries them with the data: a dossier's provenance names the licence behind each fact and its terms block carries the citation and the notices. The data terms page holds the table. A record that looks wrong is reported through data corrections, which says which upstream owns which field.