Global security advisories are CVEs and GitHub-originated advisories affecting the open source world, located in the GitHub Advisory Database.
There are two types of advisories: global security advisories and repository security advisories. Global advisories live in the GitHub Advisory Database and are grouped into three categories:
Malware advisories are advisories about malicious open source packages. We publish them automatically into the GitHub Advisory Database from the npm security team and the OpenSSF Malicious Packages repository.
Note
Dependabot doesn't generate Dependabot alerts for unreviewed and malware advisories.
Every repository advisory is reviewed by the GitHub Security Lab curation team for consideration as a global advisory. We publish security advisories for any of the ecosystems supported by the dependency graph to the GitHub Advisory Database.
Anyone can suggest improvements on any global security advisory. You can edit or add any detail, including additionally affected ecosystems, severity level or description of who is impacted. The GitHub Security Lab curation team will review the submitted improvements.
Access advisories in the GitHub Advisory Database. See Browsing security advisories in the GitHub Advisory Database.