OSV Scanner

Use OSV-Scanner to find existing vulnerabilities affecting your project’s dependencies.

Vulnerability IDs#

Each Finding gets the OSV advisory’s id as its first vulnerability ID, followed by the advisory’s aliases. An advisory keyed by a GHSA id usually lists its CVE only among the aliases.

Sample Scan Data#

Sample OSV Scanner output can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• title
• description
• severity