Building the world’s first free open source database of FOSS and their vulnerabilities.

" summary

VulnerableCode is a libre, open database that maps FOSS packages to vulnerabilities by importing and normalizing disparate vulnerability disclosures from major FOSS distributors. Instead of vendor-centric CPEs it uses Package URLs (purls) to represent packages across ecosystems, and it provides its normalized, auditable data under an open license so SCA tools and the community can consume and curate it.

AI-written summary · about

" related talks

• 32mA Vulnerability Database Should Not Be About Vulnerabilities!Hritik Vijay, Tushar Goel · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 43mOpen Source Runs the World, Why Not Vulnerability Identifiers?Josh Bressers, Josh Buker · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 41mScalable Management of Vulnerabilities in Open SourceOliver Chang, Kate Catlin · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 24mLessons from OSV: Vulnerability Management for Open SourceOliver Chang · CVE/FIRST VulnCon 2025
• 15mA vulnerability database should not be about vulnerabilities!Hrithik Vijay · IndiaFOSS 3.0
• 58mThe Open Source Paradox: Unpacking Risk, Equity, and AcceptanceVincent Danen · CVE/FIRST VulnCon 2025
• 49mTrustworthy Open Source: The Consequences of SuccessEric Brewer · USENIX ATC '22
• 27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open SourceYogesh Mittal, Pete Allor · CVE/FIRST VulnCon 2026 & Annual CNA Summit