Overview
Binarly provides a Vulnerability Database (VDB) as a managed service, eliminating the need for customers to build and maintain their own multi-source vulnerability intelligence pipeline. NVD (National Vulnerability Database) is the primary advisory source. Every other source in this list enriches NVD data by adding language- and package-specific advisories, distribution vendor patches, security research, project-level disclosures, and real-world exploitation intelligence. Together they enable findings to carry accurate severity, exploitability context, and patch status across a wide range of targets. For the best results, VDB sources are matched against the ecosystem configured for each product (e.g. Ubuntu, Red Hat, Debian). This allows the platform to cross-reference distribution-specific patches against the relevant advisory sources, ensuring findings reflect the actual patch state of the scanned environment rather than upstream version numbers alone. Source IDs (e.g.nvd, ghsa, brly) appear in API responses and report exports, allowing findings to be traced directly back to their originating source.
Primary Source
| Source | ID | Description | Link |
|---|---|---|---|
| National Vulnerability Database | nvd | The authoritative U.S. government CVE repository maintained by NIST. Provides the canonical CVE identifiers, CVSS scores, and advisory details that all other sources are correlated against. | nvd.nist.gov |
Language & Package Sources
Language and package-manager-specific advisories provide vulnerability data that NVD alone does not always capture with sufficient detail or timeliness.| Source | ID | Description | Link |
|---|---|---|---|
| GitHub Security Advisories | ghsa | Curated advisories for open-source packages across many ecosystems, published directly by maintainers and the GitHub Security Lab. | github.com/advisories |
| Rust Security Advisory Database | rustsec | Community-maintained advisories for Rust crates, covering vulnerabilities in the crates.io ecosystem. | rustsec.org |
| Python Security Advisories | pysec | Advisories for Python packages distributed via PyPI. | pypi.org |
| Go Vulnerability Database | go | The official Go team vulnerability database covering modules published to the Go module proxy. | pkg.go.dev/vuln |
| Haskell Security Advisories | hsec | Community-maintained security advisories for Haskell packages on Hackage, maintained by the Haskell Security Response Team. | github.com/haskell/security-advisories |
| Python Software Foundation | psf | Security disclosures published by the Python Software Foundation. | python.org |
| R Security Advisories | rsec | Security advisories for CRAN and Bioconductor packages, maintained by the R Consortium in OSV format. | github.com/RConsortium/r-advisory-database |
Distribution Sources
Linux distribution vendors often backport security fixes without changing upstream version numbers. These sources allow Binarly to account for patched packages in version-based detection and reduce false positives.| Source | ID | Description | Link |
|---|---|---|---|
| Ubuntu Security Notices | usn | Canonical’s official security advisories for Ubuntu packages. Used to filter patched vulnerabilities in Ubuntu-based binaries. | ubuntu.com/security/notices |
| Alma Linux Security Advisories | alsa | Security errata for AlmaLinux, a RHEL-compatible distribution. | errata.almalinux.org |
| Red Hat Security Advisories | rhsa | Official Red Hat security errata covering RHEL and related products. (coming soon) | access.redhat.com |
| Rocky Linux Security Advisories | rlsa | Security errata for Rocky Linux, a RHEL-compatible community distribution. (coming soon) | errata.rockylinux.org |
| Debian Security Advisories | debian | Official Debian security tracker covering stable and LTS releases. (coming soon) | security-tracker.debian.org |
Security Vendor Sources
| Source | ID | Description | Link |
|---|---|---|---|
| Binarly Security Research | brly | Original vulnerability research produced by Binarly’s REsearch team, including firmware and UEFI disclosures not covered by public databases. | binarly.io |
Project Sources
Direct vulnerability disclosures maintained by widely-deployed open-source projects. These may include additional context or severity assessments that differ from NVD.| Source | ID | Description | Link |
|---|---|---|---|
| OpenSSL Security Advisories | openssl | Official vulnerability disclosures from the OpenSSL project. | openssl.org |
| cURL Security Advisories | curl | Vulnerability disclosures maintained by the cURL project. | curl.se |
Exploitation Intelligence Sources
These sources provide signals about whether a vulnerability has been actively exploited in the wild or has known public exploit code. They feed directly into risk scoring and reachability analysis, allowing Binarly to surface the highest-priority findings first.| Source | ID | Description | Link |
|---|---|---|---|
| CISA Known Exploited Vulnerabilities | cisa | CISA’s authoritative catalog of CVEs actively exploited in the wild. Inclusion is a strong prioritization signal. | cisa.gov/kev |
| FIRST EPSS | first | The Exploit Prediction Scoring System (EPSS) provides a probability score (0–1) estimating the likelihood a CVE will be exploited within 30 days. | first.org/epss |
| Exploit Database | exploit-db | Offensive Security’s public archive of exploit code and proof-of-concept write-ups. | exploit-db.com |
| Metasploit Framework Modules | metasploit | Indicates whether a CVE has a weaponized module in the Metasploit penetration testing framework. | rapid7.com/metasploit |
| Nomi Sec PoCs | nomi-sec-pocs | Aggregated proof-of-concept exploit repositories on GitHub, curated by Nomi Sec. | github.com/nomi-sec |
| Nuclei Templates | nuclei-templates | Project Discovery’s library of Nuclei scanner templates, indicating a CVE has a working detection or exploitation template. | github.com/projectdiscovery |
Related
- Detection Methods — How Binarly identifies vulnerabilities using version-based and rule-based detection
- Risk Scoring — How exploitation intelligence sources influence finding priority
- Reachability — How reachability analysis uses exploitability signals to reduce noise