> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-d/09-9-vendor-os-distribution-container-and-package-affectedness-feeds.md).

# 9. Vendor, OS, distribution, container & package affectedness feeds

## 9.1 Scanner-oriented aggregators & vulnerability DB builders

<table><thead><tr><th width="89.171875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>NeuVector vul-dbgen</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/neuvector/vul-dbgen">github.com/neuvector/vul-dbgen</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Vulnerability DB generation source originally flagged by this project.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful as a reference for aggregating distro/package vulnerability feeds.</td></tr><tr><td align="right">2</td><td><strong>NeuVector vul-source</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/neuvector/vul-source">github.com/neuvector/vul-source</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Vulnerability source data used by NeuVector workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Review for source coverage &#x26; feed normalization logic.</td></tr><tr><td align="right">3</td><td><strong>Aqua Trivy vulnerability docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://trivy.dev/docs/latest/scanner/vulnerability/">trivy.dev/docs/latest/scanner/vulnerability</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Scanner behavior across OS packages, language packages, misconfig, Kubernetes, etc.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner semantics &#x26; supported target types.</td></tr><tr><td align="right">4</td><td><strong>Trivy DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/aquasecurity/trivy-db">github.com/aquasecurity/trivy-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Converts raw advisories into Trivy DB format.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for ingestion architecture &#x26; feed normalization patterns.</td></tr><tr><td align="right">5</td><td><strong>Trivy Java DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/aquasecurity/trivy-java-db">github.com/aquasecurity/trivy-java-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Java-specific vulnerability database used by Trivy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Maven/JAR matching.</td></tr><tr><td align="right">6</td><td><strong>Trivy database configuration docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://trivy.dev/docs/latest/configuration/db/">trivy.dev/docs/latest/configuration/db</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Documents Trivy DB artifacts &#x26; configuration.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for operational scanner deployment.</td></tr><tr><td align="right">7</td><td><strong>Anchore Grype</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/anchore/grype">github.com/anchore/grype</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Vulnerability scanner for container images &#x26; filesystems.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful reference for SBOM-to-vuln matching.</td></tr><tr><td align="right">8</td><td><strong>Anchore Grype DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/anchore/grype-db">github.com/anchore/grype-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Builds Grype vulnerability database from upstream sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for feed normalization &#x26; source coverage comparison.</td></tr><tr><td align="right">9</td><td><strong>Anchore Syft</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/anchore/syft">github.com/anchore/syft</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> SBOM generation for scanning &#x26; exposure matching.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Pair with Grype for inventory-to-vulnerability workflow.</td></tr><tr><td align="right">10</td><td><strong>Quay ClairCore</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/quay/claircore">github.com/quay/claircore</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Clair vulnerability matching engine core.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for container security ingestion patterns.</td></tr><tr><td align="right">11</td><td><strong>Clair</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/quay/clair">github.com/quay/clair</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Container vulnerability scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Compare feed matching behavior with Trivy &#x26; Grype.</td></tr><tr><td align="right">12</td><td><strong>VulnerableCode</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/nexB/vulnerablecode">github.com/nexB/vulnerablecode</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Open vulnerability DB aggregator.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for importer coverage &#x26; open-source ingestion architecture.</td></tr><tr><td align="right">13</td><td><strong>VulnerableCode importer docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://vulnerablecode.readthedocs.io/en/latest/importers_link.html">vulnerablecode.readthedocs.io/en/latest/importers_link.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Lists supported importer sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good checklist for source coverage.</td></tr><tr><td align="right">14</td><td><strong>Dependency-Track</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://dependencytrack.org/">dependencytrack.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source core project</td><td><strong><code>Relevance</code>:</strong> SBOM-oriented vulnerability management platform.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful reference for BOM ingestion &#x26; component risk tracking.</td></tr><tr><td align="right">15</td><td><strong>Dependency-Track data sources</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.dependencytrack.org/datasources/overview/">docs.dependencytrack.org/datasources/overview</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Documents Dependency-Track data sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for comparing source prioritization.</td></tr><tr><td align="right">16</td><td><strong>Dependency-Track GitHub Advisories datasource</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.dependencytrack.org/datasources/github-advisories/">docs.dependencytrack.org/datasources/github-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Mirrors GHSA via GitHub public GraphQL API.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful reference for GHSA ingestion.</td></tr><tr><td align="right">17</td><td><strong>OpenVAS / Greenbone Community Feed</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.greenbone.net/en/community-feed/">www.greenbone.net/en/community-feed</a><br><br><strong><code>Access / Cost</code>:</strong> Free community feed; commercial Greenbone feeds/products available</td><td><strong><code>Relevance</code>:</strong> Network vulnerability test feed.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for host/network exposure detection, not package-only matching.</td></tr><tr><td align="right">18</td><td><strong>Wazuh vulnerability detector</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/index.html">documentation.wazuh.com/current/user-manual/capabilities/vulnerability- detection/index.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs; Wazuh open-source, commercial support available</td><td><strong><code>Relevance</code>:</strong> Endpoint vulnerability detection capability.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for host-level package inventory &#x26; vuln matching behavior.</td></tr><tr><td align="right">19</td><td><strong>OSV-SCALIBR</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/google/osv-scalibr">github.com/google/osv-scalibr</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Google library for Software Composition Analysis.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for SCA implementation patterns, package/component extraction, vulnerability matching, &#x26; OSV-aligned workflows.</td></tr><tr><td align="right">20</td><td><strong>HarborGuard</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/HarborGuard/HarborGuard">github.com/HarborGuard/HarborGuard</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Image vulnerability scanning &#x26; patching platform with multi-tool integration.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Relevant to container/image vulnerability management, scanner orchestration, &#x26; remediation workflow automation.</td></tr></tbody></table>

## 9.2 Red Hat / RHEL / CentOS Stream

<table><thead><tr><th width="102.44921875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Red Hat Security Data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data; some product details/support content may require subscription</td><td><strong><code>Relevance</code>:</strong> Red Hat CSAF/VEX, OSV, OVAL, CVE data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Essential for RHEL affectedness &#x26; backport-aware status.</td></tr><tr><td align="right">2</td><td><strong>Red Hat Security Data API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.redhat.com/en/documentation/red_hat_security_data_api/1.0/html-single/red_hat_security_data_api/index">docs.redhat.com/en/documentation/red_hat_security_data_api/1.0/html- single/red_hat_security_data_api/index</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs/API; support content may require subscription</td><td><strong><code>Relevance</code>:</strong> API retrieves Red Hat CVE/advisory/security data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Prefer API for automation; handle auth/rate constraints if applicable.</td></tr><tr><td align="right">3</td><td><strong>Red Hat CVE database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/security-updates/#/cve">access.redhat.com/security/security-updates/#/cve</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Red Hat CVE lookup.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Human-facing; use data APIs for automation.</td></tr><tr><td align="right">4</td><td><strong>Red Hat OVAL data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.redhat.com/security/data/oval/">www.redhat.com/security/data/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> OVAL definitions for vulnerability assessment.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner compatibility &#x26; package-state evaluation.</td></tr><tr><td align="right">5</td><td><strong>Red Hat CSAF/VEX guidance</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://redhatproductsecurity.github.io/security-data-guidelines/csaf-vex/">redhatproductsecurity.github.io/security-data-guidelines/csaf-vex</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Explains Red Hat CSAF/VEX &#x26; product/package semantics.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for correct interpretation of affected/not-affected states.</td></tr><tr><td align="right">6</td><td><strong>Red Hat security advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/security-updates/#/security-advisories">access.redhat.com/security/security-updates/#/security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public listing; some advisory/product support details may require subscription</td><td><strong><code>Relevance</code>:</strong> Red Hat advisory listing.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for patch/remediation references.</td></tr><tr><td align="right">7</td><td><strong>CentOS Stream security tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://gitlab.com/redhat/centos-stream/rpms">gitlab.com/redhat/centos-stream/rpms</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitLab</td><td><strong><code>Relevance</code>:</strong> CentOS Stream package source context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use carefully; package repo state differs from security advisory truth.</td></tr></tbody></table>

## 9.3 Debian

<table><thead><tr><th width="90.234375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Debian Security Tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security-tracker.debian.org/">security-tracker.debian.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Debian-specific package vulnerability status.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Essential for Debian affectedness &#x26; backported patches.</td></tr><tr><td align="right">2</td><td><strong>Debian Security Tracker JSON</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security-tracker.debian.org/tracker/data/json">security-tracker.debian.org/tracker/data/json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public JSON</td><td><strong><code>Relevance</code>:</strong> Machine-readable Debian vulnerability data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Primary automation source for Debian.</td></tr><tr><td align="right">3</td><td><strong>Debian Security Tracker source Git</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://salsa.debian.org/security-tracker-team/security-tracker">salsa.debian.org/security-tracker-team/security-tracker</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public Git repo</td><td><strong><code>Relevance</code>:</strong> Source repo for tracker data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for diffs, auditing, &#x26; local mirroring.</td></tr><tr><td align="right">4</td><td><strong>Debian Security Information</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.debian.org/security/">www.debian.org/security</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Debian security notices &#x26; process context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for advisory references &#x26; manual review.</td></tr><tr><td align="right">5</td><td><strong>Debian Security Tracker docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security-team.debian.org/security_tracker.html">security-team.debian.org/security_tracker.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Explains Debian tracker semantics.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for interpreting statuses like fixed, vulnerable, ignored, or postponed.</td></tr><tr><td align="right">6</td><td><strong>Debian OVAL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.debian.org/security/oval/">www.debian.org/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> OVAL data for Debian vulnerability assessment.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner integrations.</td></tr></tbody></table>

## 9.4 Ubuntu / Canonical

<table><thead><tr><th width="92.88671875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Ubuntu Security Notices</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ubuntu.com/security/notices">ubuntu.com/security/notices</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Ubuntu security notices for fixed packages.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for patch references &#x26; release-specific remediation.</td></tr><tr><td align="right">2</td><td><strong>Ubuntu CVE reports</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ubuntu.com/security/cves">ubuntu.com/security/cves</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Ubuntu CVE tracking by package/release.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for Ubuntu affectedness &#x26; backport interpretation.</td></tr><tr><td align="right">3</td><td><strong>Ubuntu OVAL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ubuntu.com/security/oval">ubuntu.com/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> OVAL data for vulnerability assessment &#x26; patch status.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner compatibility.</td></tr><tr><td align="right">4</td><td><strong>Ubuntu VEX data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ubuntu.com/security/vex">ubuntu.com/security/vex</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Ubuntu VEX data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for affected/not-affected status &#x26; scanner false-positive reduction.</td></tr><tr><td align="right">5</td><td><strong>Ubuntu VEX docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://documentation.ubuntu.com/security/security-updates/vex/">documentation.ubuntu.com/security/security-updates/vex</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Ubuntu VEX source documentation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for interpreting Canonical VEX publication model.</td></tr><tr><td align="right">6</td><td><strong>Ubuntu Security Notices GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/canonical/ubuntu-security-notices">github.com/canonical/ubuntu-security-notices</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> USN/LSN JSON, OSV JSON, &#x26; OpenVEX JSON formats.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong automation source. Preserve format-specific semantics.</td></tr><tr><td align="right">7</td><td><strong>Ubuntu Security Tracker Git</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://git.launchpad.net/ubuntu-cve-tracker">git.launchpad.net/ubuntu-cve-tracker</a><br><br><strong><code>Access / Cost</code>:</strong> Free public Git repo</td><td><strong><code>Relevance</code>:</strong> Ubuntu CVE tracker source.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for local mirroring &#x26; historical diffing.</td></tr><tr><td align="right">8</td><td><strong>Ubuntu security updates docs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://documentation.ubuntu.com/security/security-updates/">documentation.ubuntu.com/security/security-updates</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs</td><td><strong><code>Relevance</code>:</strong> Ubuntu security update documentation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for process context &#x26; VEX/OVAL interpretation.</td></tr></tbody></table>

## 9.5 Alpine

<table><thead><tr><th width="89.6796875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Alpine SecDB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://secdb.alpinelinux.org/">secdb.alpinelinux.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Current Alpine machine-readable security DB.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Primary Alpine ingestion source.</td></tr><tr><td align="right">2</td><td><strong>Alpine Security Tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security.alpinelinux.org/">security.alpinelinux.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Tracks Alpine security issues.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for human review &#x26; status context.</td></tr><tr><td align="right">3</td><td><strong>Alpine SecDB deprecated GitHub mirror</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/alpinelinux/alpine-secdb">github.com/alpinelinux/alpine-secdb</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo; deprecated</td><td><strong><code>Relevance</code>:</strong> Historical Alpine SecDB mirror.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Deprecated; do not rely on it for current ingestion.</td></tr><tr><td align="right">4</td><td><strong>Alpine packages</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pkgs.alpinelinux.org/packages">pkgs.alpinelinux.org/packages</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Alpine package metadata.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not a vulnerability DB, but helps resolve package names &#x26; versions.</td></tr></tbody></table>

## 9.6 SUSE / openSUSE

<table><thead><tr><th width="93.37109375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>SUSE CSAF</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.suse.com/support/security/csaf/">www.suse.com/support/security/csaf</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> SUSE CSAF advisory data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for vendor-asserted affectedness &#x26; remediation states.</td></tr><tr><td align="right">2</td><td><strong>SUSE CVRF / OVAL security data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.suse.com/support/security/oval/">www.suse.com/support/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> SUSE OVAL/CVRF security data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner compatibility &#x26; package-state evaluation.</td></tr><tr><td align="right">3</td><td><strong>SUSE CVE pages</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.suse.com/security/cve/">www.suse.com/security/cve</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> SUSE CVE lookup.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Human-facing; use machine-readable feeds when available.</td></tr><tr><td align="right">4</td><td><strong>SUSE Security Advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.suse.com/support/update/announcement/">www.suse.com/support/update/announcement</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> SUSE security advisory listing.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for remediation &#x26; patch references.</td></tr><tr><td align="right">5</td><td><strong>openSUSE Security Announce</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/">lists.opensuse.org/archives/list/security-announce@lists.opensuse.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> openSUSE security announcement mailing list archive.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for distro-specific disclosure context.</td></tr></tbody></table>

## 9.7 Oracle Linux

<table><thead><tr><th width="93.2109375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Oracle Security Alerts &#x26; Critical Patch Updates</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.oracle.com/security-alerts/">www.oracle.com/security-alerts</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Oracle CPU, Security Alerts, third-party bulletins, &#x26; CVE mappings.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Oracle products often require vendor advisory interpretation beyond NVD.</td></tr><tr><td align="right">2</td><td><strong>Oracle Linux security data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://linux.oracle.com/security/">linux.oracle.com/security</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Oracle Linux security data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Oracle Linux affectedness.</td></tr><tr><td align="right">3</td><td><strong>Oracle Linux OVAL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://linux.oracle.com/security/oval/">linux.oracle.com/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Oracle Linux OVAL definitions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for scanner compatibility.</td></tr></tbody></table>

\| 4 | Oracle Linux errata | [linux.oracle.com/errata](https://linux.oracle.com/errata/) | Free public | Oracle Linux errata. | Use for patch mapping & fixed versions. | | 5 | Oracle Linux CVE search | [linux.oracle.com/cve](https://linux.oracle.com/cve/) | Free public | Oracle Linux CVE lookup. | Human lookup source; pair with OVAL/errata for automation. |

## 9.8 Amazon Linux

<table><thead><tr><th width="89.87109375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Amazon Linux Security Center</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://alas.aws.amazon.com/">alas.aws.amazon.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Amazon Linux security advisory portal.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for Amazon Linux package affectedness.</td></tr><tr><td align="right">2</td><td><strong>Amazon Linux ALAS Explorer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://explore.alas.aws.amazon.com/">explore.alas.aws.amazon.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Search/explore interface for Amazon Linux advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for manual triage &#x26; ALAS advisory lookup.</td></tr><tr><td align="right">3</td><td><strong>Amazon Linux 2 advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://alas.aws.amazon.com/alas2.html">alas.aws.amazon.com/alas2.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Amazon Linux 2 advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Version-specific advisory stream.</td></tr><tr><td align="right">4</td><td><strong>Amazon Linux 2023 advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://alas.aws.amazon.com/AL2023/">alas.aws.amazon.com/AL2023</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Amazon Linux 2023 advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Keep AL2 &#x26; AL2023 separate because package baselines differ.</td></tr><tr><td align="right">5</td><td><strong>AWS Security Bulletins</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://aws.amazon.com/security/security-bulletins/">aws.amazon.com/security/security-bulletins</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> AWS security bulletins for services &#x26; platforms.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Cloud-service affectedness may not map cleanly to package versions.</td></tr><tr><td align="right">6</td><td><strong>Amazon Linux 2023 GitHub repository</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/amazonlinux/amazon-linux-2023">github.com/amazonlinux/amazon-linux-2023</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Amazon Linux 2023 project repository.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Amazon Linux 2023 package context, release notes, source/package metadata references, &#x26; distro-specific affectedness workflows.</td></tr></tbody></table>

## 9.9 Fedora, AlmaLinux, Rocky, Arch, Gentoo

<table><thead><tr><th width="94.38671875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Fedora security updates</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://bodhi.fedoraproject.org/updates/?type=security">bodhi.fedoraproject.org/updates/?type=security</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Fedora security update advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Fedora package remediation tracking.</td></tr><tr><td align="right">2</td><td><strong>Fedora packages</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packages.fedoraproject.org/">packages.fedoraproject.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Fedora package metadata.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Not a vulnerability DB, but useful for package identity &#x26; version resolution.</td></tr><tr><td align="right">3</td><td><strong>Fedora packages static - Pagure</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://pagure.io/fedora-packages-static">pagure.io/fedora-packages-static</a><br><br><strong><code>Access / Cost</code>:</strong> Free public Pagure project; manually revalidate</td><td><strong><code>Relevance</code>:</strong> Fedora package-name &#x26; metadata/script reference.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Keep in link-check allowlist until manually validated; not a primary security advisory source.</td></tr><tr><td align="right">4</td><td><strong>AlmaLinux Errata</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://errata.almalinux.org/">errata.almalinux.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> AlmaLinux errata &#x26; security advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for RHEL-compatible distro assessment.</td></tr><tr><td align="right">5</td><td><strong>AlmaLinux OSV data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/AlmaLinux/osv-database">github.com/AlmaLinux/osv-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> AlmaLinux OSV-formatted data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for OSV-based pipelines.</td></tr><tr><td align="right">6</td><td><strong>Rocky Linux security advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://errata.build.resf.org/">errata.build.resf.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Rocky Linux errata/security advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for RHEL-compatible distro assessment.</td></tr><tr><td align="right">7</td><td><strong>Arch Linux Security Tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security.archlinux.org/">security.archlinux.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Arch Linux security tracker.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Rolling-release semantics differ from fixed-release distros.</td></tr><tr><td align="right">8</td><td><strong>Arch Linux security JSON</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security.archlinux.org/json">security.archlinux.org/json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public JSON</td><td><strong><code>Relevance</code>:</strong> Machine-readable Arch security data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for automation.</td></tr><tr><td align="right">9</td><td><strong>Gentoo GLSA</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security.gentoo.org/glsa/">security.gentoo.org/glsa</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Gentoo Linux Security Advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Gentoo package affectedness.</td></tr><tr><td align="right">10</td><td><strong>Gentoo GLSA XML</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security.gentoo.org/glsa/feed.rss">security.gentoo.org/glsa/feed.rss</a><br><br><strong><code>Access / Cost</code>:</strong> Free public RSS/XML</td><td><strong><code>Relevance</code>:</strong> Gentoo GLSA RSS/XML feed.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for feed-based monitoring.</td></tr></tbody></table>

## 9.10 Wolfi / Chainguard

<table><thead><tr><th width="91.15234375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Wolfi OS advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/wolfi-dev/advisories">github.com/wolfi-dev/advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Wolfi OS advisory data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for modern minimal container images.</td></tr><tr><td align="right">2</td><td><strong>Wolfi SecDB generator</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/wolfi-dev/secdb">github.com/wolfi-dev/secdb</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Generates Wolfi security DBs based on Alpine secdb format.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for understanding feed generation semantics.</td></tr><tr><td align="right">3</td><td><strong>Wolfi OS feed</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packages.wolfi.dev/os/security.json">packages.wolfi.dev/os/security.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public feed</td><td><strong><code>Relevance</code>:</strong> Wolfi package security feed.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use this for Wolfi base images.</td></tr><tr><td align="right">4</td><td><strong>Chainguard Enterprise feed</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packages.cgr.dev/chainguard/security.json">packages.cgr.dev/chainguard/security.json</a><br><br><strong><code>Access / Cost</code>:</strong> Publicly reachable feed; may relate to commercial Chainguard product scope</td><td><strong><code>Relevance</code>:</strong> Chainguard Enterprise package security feed.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Separate from Wolfi OS feed. Confirm entitlement/licensing before commercial redistribution.</td></tr><tr><td align="right">5</td><td>Chainguard security advisories docs</td><td><a href="https://edu.chainguard.dev/chainguard/chainguard-images/staying-secure/security-advisories/how-chainguard-issues/">edu.chainguard.dev/chainguard/chainguard-images/staying- secure/security-advisories/how-chainguard-issues</a></td></tr><tr><td align="right">6</td><td>Wolfi vulnerabilities in OSV</td><td><a href="https://osv.dev/list?ecosystem=Wolfi">osv.dev/list?ecosystem=Wolfi</a></td></tr><tr><td align="right">7</td><td>Chainguard OSV advisory feed context</td><td><a href="https://www.chainguard.dev/unchained/chainguard-enhances-security-with-osv-advisory-feed">www.chainguard.dev/unchained/chainguard-enhances-security-with- osv-advisory-feed</a></td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-d/09-9-vendor-os-distribution-container-and-package-affectedness-feeds.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.