OSV Advisory Lookup: Security Advisories by Package or CVE
Page updated
Price: $0.10 per 1,000 advisories, flat on every Apify plan, no start fee. Free-plan cap: up to 100 advisories per run on the Apify Free plan. Prices checked on 2026-10-17.
The OSV Advisory Lookup sends your packages and advisory IDs to the public OSV.dev API and returns one row per advisory, with affected and fixed versions, severity and links.
Every row names its source database and that database’s license, so you know how each entry may be reused.
Who it is for
Developers, DevOps and security teams, and SBOM or compliance tools that need advisory data for a list of dependencies.
- Check a project's dependencies for known advisories before a release.
- Enrich an SBOM with severity and fixed versions.
- Look up a list of CVE or GHSA IDs in one run.
- Plan upgrades by finding the first fixed version per package.
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
| packages | array of strings | No | ecosystem:name or ecosystem:name@version, e.g. npm:[email protected]. With a version, only advisories affecting it are returned. |
| advisoryIds | array of strings | No | Advisory IDs to look up directly, e.g. CVE-2021-44228 or a GHSA ID. |
| maxItems | integer | No | Default 1,000, up to 5,000 advisory rows. |
Example input
{
"packages": [
"npm:[email protected]",
"PyPI:[email protected]"
],
"advisoryIds": [
"CVE-2021-44228"
],
"maxItems": 200
}Example output
[
{
"type": "advisory",
"id": "GHSA-29mw-wpgm-hmr9",
"aliases": [
"CVE-2020-28500"
],
"query": "npm:[email protected]",
"summary": "Regular Expression Denial of Service (ReDoS) in lodash",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"severityLabel": "MODERATE",
"cwes": [
"CWE-1333",
"CWE-400"
],
"published": "2022-01-06T20:30:46Z",
"modified": "2025-09-29T21:12:31.102523Z",
"withdrawn": null,
"packages": [
{
"ecosystem": "npm",
"name": "lodash",
"purl": "pkg:npm/lodash"
},
{
"ecosystem": "npm",
"name": "lodash-es",
"purl": "pkg:npm/lodash-es"
}
],
"introducedVersions": [
"4.0.0"
],
"fixedVersions": [
"4.17.21"
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/6139"
}
],
"osvUrl": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
"sourceDatabase": "GitHub Advisory Database",
"sourceLicense": "CC-BY-4.0",
"sourceLicenseUrl": "https://github.com/github/advisory-database/blob/main/LICENSE.md",
"sourceUrl": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json",
"dataSourcesUrl": "https://google.github.io/osv.dev/data/"
}
]Price
$0.10 per 1,000 advisories
Free-plan cap: Up to 100 advisories per run on the Apify Free plan
Billing happens on Apify, not on this website.
Limits
- Up to 100 advisories per run on the Apify Free plan.
- Each entry keeps its source database's license. Check sourceLicense before you reuse it.
- Data is what OSV.dev publishes. New advisories can take time to appear.
What it does not do
- It returns advisory data and links only, never code.
- It does not scan your code or lockfiles. You give it the package list.
- It does not return the long free-text details field.
FAQ
What counts as a result?
One advisory returned from OSV.dev.
Do I pay for packages with no advisories?
No. No-results, invalid-input, error and limit rows are free.
Where does the data come from?
From the public OSV.dev API, which combines many advisory databases. Lepidata is not affiliated with Google or OSV.dev.
Is there a start fee?
No. You pay only the flat price per result.