# Data sources

Source: https://libwatch.com/en/data-sources

Trust · Legal

LibWatch relies on public vulnerability databases and on the official registries of each language. We thank their maintainers. Mentioning them does not imply any endorsement of LibWatch by these organizations.

This English translation is provided for convenience only. The French version is the only legally binding one and prevails in case of any discrepancy: [read it in French](/sources.md).

Last updated: October 23, 2026

Sources: 12

Code sent: None

Information provided without warranty

 A public database may be incomplete or lag behind, and the absence of a reported vulnerability does not prove that there is none.

Vulnerabilities

## Where vulnerabilities come from

Vulnerability sources, with their licenses| Source | What LibWatch uses it for | License and notice |
| --- | --- | --- |
| NVD | CVSS scores and vulnerability descriptions | “This product uses the NVD API but is not endorsed or certified by the NVD.” A score recalculated or modified by LibWatch is no longer attributed to the NVD |
| CVE Program (MITRE) | CVE™ vulnerability identifiers and descriptions | CVE™ data © The MITRE Corporation, used under the [CVE Terms of Use](https://www.cve.org/Legal/TermsOfUse) (license reproduced below) |
| CERT-FR (ANSSI) | Alerts and advisories on languages, such as PHP: CVE identifiers and affected versions. Only these items, the title and the link are kept | [Licence Ouverte 2.0](https://www.etalab.gouv.fr/licence-ouverte-open-licence/) (Etalab, French government open license): reuse permitted with attribution of the source. Each vulnerability links to the dated advisory that reports it |
| GitHub Advisory Database | Security advisories per package | © GitHub, Inc., under the CC BY 4.0 license. Data adapted by LibWatch: selection and matching with the project's dependencies. Source: [github.com/advisories](https://github.com/advisories) |
| OSV.dev (Google) | Open source vulnerability aggregator | Each record keeps the license of its original database: details below. Source: [osv.dev](https://osv.dev) |
| EPSS (FIRST) | Probability that a vulnerability will be exploited within the next 30 days | See EPSS at https://www.first.org/epss |
| KEV catalog (CISA) | List of actively exploited vulnerabilities | Public domain (CC0 1.0). LibWatch is neither affiliated with nor endorsed by CISA |
| Wordfence Intelligence | Vulnerabilities in WordPress plugins, themes and core, for WordPress projects | © Defiant, Inc. Each vulnerability shown links to its Wordfence record. Records that come from the CVE Program carry the MITRE copyright notice provided by Wordfence |

Versions and end of life

## Where versions come from

Sources of versions and end-of-life dates, with their licenses| Source | What LibWatch uses it for | License and notice |
| --- | --- | --- |
| Official registries | Published versions, read from npm, RubyGems, PyPI, Packagist, crates.io, Go module proxy, NuGet, pub.dev, CocoaPods and api.wordpress.org | Terms of use of each registry |
| deps.dev (Google) | Versions of Maven and Gradle packages, and dependency graphs | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). The “estimated” indirect dependencies are computed by LibWatch from this data. Source: [deps.dev](https://deps.dev) |
| endoflife.date | End-of-life dates of languages and frameworks | Open source project, MIT license. Source: [endoflife.date](https://endoflife.date) |
| Google Play requirements | Target API level required for Android apps | Collected by LibWatch from the public Android developer documentation. Last checked: September 17, 2026. Source: [developer.android.com](https://developer.android.com/google/play/requirements/target-sdk) |

Good to know

The details that the licenses require us to display.

## Licenses of OSV.dev records

- CC BY 4.0: GitHub Advisory Database, PyPI Advisory Database, Go Vulnerability Database, OSS-Fuzz, Python Software Foundation, Erlang Ecosystem Foundation.
- CC0 1.0: RustSec Advisory Database, Global Security Database, Haskell Security Advisories, opam.
- MIT license: Drupal, AlmaLinux.
- Apache 2.0 license: RConsortium, OpenSSF Malicious Packages, Bitnami.

Full list: [google.github.io/osv.dev/data](https://google.github.io/osv.dev/data/).

## Language vulnerabilities

Go: the official Go database via OSV (stdlib and toolchain). PHP: Bitnami via OSV, under the Apache-2.0 license, supplemented by the advisories and alerts of CERT-FR (ANSSI), reused under the Licence Ouverte 2.0: only the CVE identifiers, the affected versions and the link to the advisory are reused, and each vulnerability links to the dated advisory that reports it. This partial coverage concerns the interpreters distributed by Bitnami; applicability must be confirmed with the vendor. The history collected since 2020 does not cover every vulnerability of older projects. The RubySec, Node Security WG and PSF sources are yet to be integrated. Only stable versions pinned to three components are queried; a constraint, a pre-release or an imprecise version cannot be checked.

[Bitnami/vulndb](https://github.com/bitnami/vulndb) — [Go Vulnerability Database](https://vuln.go.dev) — [CERT-FR](https://cert.cyber.gouv.fr)

## Exact notices

NVD, exact notice:

> This product uses the NVD API but is not endorsed or certified by the NVD.

CVE Program, exact license:

> CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
>
> DISCLAIMERS
>
> ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.

EPSS (FIRST), requested citation:

> See EPSS at https://www.first.org/epss

## What LibWatch does not use

- npm's own security data (npm audit).
- The logo or seal of CISA, DHS, the NVD or MITRE.

## A question about these documents?

Write to us: we reply by email on business days.

[bonjour@isee-u.fr](mailto:bonjour@isee-u.fr)