Vulnerability databases
Leavory consolidates four public databases and updates them every day. For each vulnerability, the publication date comes from the first source that knows it, in this order:
| Order | Source | What it is |
|---|---|---|
| 1 | NVD | The US government’s official CVE database (NIST) |
| 2 | CVE.org | The official registry of CVE identifiers |
| 3 | GHSA | GitHub Advisory Database, with advisories for language packages |
| 4 | OSV | An open database that gathers advisories from many ecosystems and distributions |
That’s why Leavory can date vulnerabilities that scanners usually leave without a date, such as GHSA advisories without a CVE and CVEs that NVD hasn’t analyzed yet.
The Security Gate date database
Section titled “The Security Gate date database”The Security Gate uses a compact version of this database, with only the ID and the publication date.
- It is signed by Leavory. The step verifies the signature before using it, so a database tampered with in transit is detected.
- It is updated once a day, or more often when new vulnerabilities appear the same day.
- A vulnerability published after the latest update shows as No date until the next one.