Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time
December 26, 2022 22:29
January 30, 2023 22:37
October 3, 2022 13:04
June 17, 2022 23:12
June 17, 2022 23:45
December 26, 2022 22:29
November 14, 2022 11:40
January 25, 2023 20:55


Build Status Code License Data License Python 3.8+ stability-wip Gitter chat

VulnerableCode is a free and open database of open source software package vulnerabilities because open source software vulnerabilities data and tools should be free and open source themselves:

we are trying to change this and evolve the status quo in a few other areas!

  • Vulnerability databases have been traditionally proprietary even though they are mostly about free and open source software.
  • Vulnerability databases also often contain a lot of lesser value data which means a lot of false positive signals that require extensive expert reviews.
  • Vulnerability databases are also mostly about vulnerabilities first and software package second, making it difficult to find if and when a vulnerability applies to a piece of code. VulnerableCode focus is on software package first where a Package URL is a key and natural identifier for packages; this is making it easier to find a package and whether it is vulnerable.

Package URL themselves were designed first in ScanCode and VulnerableCode and are now a de-facto standard for vulnerability management and package references.


The VulnerableCode project is a FOSS community resource to help improve the security of the open source software ecosystem and its users at large.

VulnerableCode consists of a database and the tools to collect, refine and keep the database current.


VulnerableCode is under active development and is not yet fully usable.

Read more about VulnerableCode

VulnerableCode is financially supported by NLnet, nexB, Google (through the GSoC) and the active contributions of several volunteers.

VulnerableCode tech stack is Python, Django, PostgreSQL, nginx and Docker and several libraries.

Getting started

Run with Docker

First install docker and docker-compose, then run:

git clone && cd vulnerablecode
make envfile
docker-compose build
docker-compose up -d
docker-compose run vulnerablecode ./ import --list

Then run an importer for nginx advisories (which is small):

docker-compose exec vulnerablecode ./ import vulnerabilities.importers.nginx.NginxImporter
docker-compose exec vulnerablecode ./ improve --all

At this point, the VulnerableCode app and API should be up and running with some data at http://localhost

Populate VulnerableCode database

VulnerableCode data collection works in two steps: importing data from multiple sources and then refining and improving how package and software vulnerabilities are related.

To run all importers and improvers use this:

./ import --all
./ improve --all

Local development installation

On a Debian system, use this:

sudo apt-get install  python3-venv python3-dev postgresql libpq-dev build-essential
git clone && cd vulnerablecode
make dev envfile postgres
make test
./ import vulnerabilities.importers.nginx.NginxImporter
./ improve --all
make run

At this point, the VulnerableCode app and API is up at


VulnerableCode comes with a minimal web UI:


And a JSON API and its minimal web documentation:




Copyright (c) nexB Inc. and others. All rights reserved.

VulnerableCode is a trademark of nexB Inc.

SPDX-License-Identifier: Apache-2.0 AND CC-BY-SA-4.0

VulnerableCode software is licensed under the Apache License version 2.0.

VulnerableCode data is licensed collectively under CC-BY-SA-4.0.

See for the license text.

See for the license text.

See for support or download.

See for more information about nexB OSS projects.