OSV
Open Source Vulnerabilities
Schwachstellendatenbank für Open-Source-Software
OSV is an open vulnerability database and an associated data schema focused on open-source dependencies. Instead of tying to product names, OSV ties precisely to package versions in the respective language ecosystems and thereby answers whether a concrete dependency is affected. For software supply-chain security this is a decisive difference.
History & facts. OSV emerged from the observation that classic, CPE-based vulnerability matching fits modern, package-based software poorly. The open OSV schema describes affected versions in a machine-readable and exact way; the associated database aggregates entries from many ecosystems and advisory sources. This makes it possible to check automatically whether a library used in a project is vulnerable in exactly the deployed version.
Outlook & recommendation. With the CRA and the growing importance of software bills of materials (SBOM), precise dependency analysis becomes mandatory. OSV is a central building block here: combined with an SBOM it reliably answers which component is vulnerable in which version — the basis for targeted patching instead of blanket updates.