The Security ontology models CVE vulnerabilities, vendor security advisories (RHSA, DSA, GLSA), and CVSS severity scores. It links vulnerabilities to affected and fixed package versions, enabling SPARQL queries such as finding all packages in a distribution affected by a given CVE, or listing unpatched vulnerabilities for a release.
A comprehensive ontology for modeling security vulnerabilities (CVEs), vendor security advisories (RHSA, DSA, GLSA), severity scoring, and their relationships to affected and fixed package versions.
Ontology for representing security vulnerabilities, advisories, and their relationships to software packages
Package Security Ontology
The date when the vulnerability was publicly disclosed.
The date the vulnerability was publicly disclosed
published date
The versioning scheme: SEMVER (semantic versioning), ECOSYSTEM (ecosystem-specific), or GIT (git commit hashes), as a SKOS concept from sec:RangeTypeScheme. Maps to OSV schema's affected[].ranges[].type field.
The versioning scheme used in this affected range
range type
Associates a vulnerability with the package version that contains its fix.
Links a vulnerability to the package version containing its fix
fixed in version
The impact on system availability: none, low, or high.
The impact on system availability if the vulnerability is exploited
impact on availability
Associates a fixed package version with the patch activity that produced it from the prior version.
Links a fixed package version to the patch activity that produced it
patch produced version
The unique Common Vulnerabilities and Exposures identifier.
The unique CVE identifier for the vulnerability
CVE identifier
The complete CVSS vector string encoding attack vector, complexity, privileges required, and impact metrics. Format varies by CVSS version.
The full CVSS vector string encoding all metric values
vector string
The date when the vulnerability record was last modified.
The date the vulnerability record was last modified
updated date
The complexity of the attack required to exploit the vulnerability.
The complexity of the attack required to exploit the vulnerability
access complexity
Associates a vulnerability with a CVSS score entity. Multiple scores can exist per vulnerability for different CVSS versions (2.0, 3.0, 3.1, 4.0). NVD routinely provides both CVSS v2 and v3.1 — reification allows both to coexist.
Links a vulnerability to a reified CVSS assessment
has CVSS score
Associates a vulnerability with a Common Weakness Enumeration category entity, enabling classification and analysis of vulnerability types.
Links a vulnerability to a CWE weakness category entity
has CWE
The severity classification: low, medium, high, or critical.
The severity level of the vulnerability
severity
Associates a vulnerability directly with an affected package identity, bypassing version-string joins for direct package-level queries. This is a convenience shortcut that trades precision for query simplicity.
Convenience shortcut linking a vulnerability directly to an affected package identity. IMPRECISE: This property links to the PackageIdentity (all versions) without specifying affected version ranges. For version-specific vulnerability queries, use hasAffectedRange instead. Useful for quick 'is this package name affected?' queries but produces false positives if the package has been patched in some versions.
affects package
Associates an affected range with version or commit markers indicating when a vulnerability was introduced, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] array.
Links an affected range to a discrete event marking when the vulnerability was introduced, fixed, or last affected
has range event
A reified affected range entity that associates a vulnerability with an ecosystem, package name, version range type (SEMVER/ECOSYSTEM/GIT), and discrete range events (introduced/fixed/last_affected). This models the OSV schema's affected[].ranges[] structure, enabling precise version-specific vulnerability queries.
A version range specification for packages affected by a vulnerability, following the OSV schema model
Affected Range
A human-readable description of the vulnerability.
A human-readable summary of the vulnerability
summary
The unique identifier for the security advisory.
The unique identifier for the security advisory
advisory identifier
A vendor-issued security advisory (such as RHSA, DSA, or GLSA) that documents and addresses one or more known vulnerabilities, providing guidance and fixes for affected packages.
A vendor security advisory that addresses one or more vulnerabilities
Security Advisory
The inverse relationship of affectsPackage, linking a package identity to the vulnerabilities that affect it. Enables efficient 'what CVEs affect this package' queries.
Links a package identity to vulnerabilities that affect it
has vulnerability report
The CVSS exploitability sub-score.
The CVSS exploitability sub-score
exploitability score
The CVSS impact sub-score.
The CVSS impact sub-score
impact score
Specifies which package ecosystem this affected range applies to (e.g., PyPI, npm, Debian). Maps to OSV schema's affected[].package.ecosystem field.
Links an affected range to the package ecosystem it applies to
affects ecosystem
Associates a vulnerability or advisory with a reified CVE identifier entity, enabling graph-traversable relationships across all records that reference the same CVE.
Links a vulnerability or advisory to a shared CVE identifier entity
CVE entity
The overall severity level assigned to the advisory, as a SKOS concept from sec:SeverityScheme.
The overall severity level of the advisory
advisory severity
The category of advisory (security, bugfix, or enhancement), as a SKOS concept from sec:AdvisoryCategoryScheme.
The category of advisory
advisory type
The attack vector: network, adjacent, local, or physical.
The attack vector for the vulnerability
access vector
The Common Weakness Enumeration identifier classifying the vulnerability type.
The CWE identifier classifying the vulnerability type
CWE identifier
Links a security advisory to the vulnerabilities it addresses.
Links a security advisory to the vulnerabilities it addresses
addresses vulnerability
The canonical Open Source Vulnerability database identifier (e.g., GHSA-xxxx-xxxx-xxxx, PYSEC-2024-xxxx, RUSTSEC-2024-xxxx). Maps to OSV schema's id field. Not all vulnerabilities have CVE identifiers — this is the primary key.
The canonical OSV database identifier for this vulnerability
OSV identifier
Associates a vulnerability with the package versions it affects.
Links a vulnerability to the package versions it affects
affects version
A packaging activity that applies one or more security patches to address vulnerabilities, producing a new package version derived from the unpatched version.
An activity that applies a security patch to produce a fixed package version
Patch Activity
Indicates whether this event marks when the vulnerability was introduced into the codebase, when it was fixed, or the last known affected version, as a SKOS concept from sec:EventTypeScheme. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field names.
The type of range event: introduced, fixed, or last_affected
event type
A version or commit marker indicating when a vulnerability was introduced into the codebase, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] structure.
A discrete event in a vulnerability's affected version range (introduced, fixed, or last_affected)
Range Event
The CVSS temporal score adjusting the base score based on current exploit code maturity, remediation level, and report confidence. Optional — not all assessments include temporal scoring.
The CVSS temporal score accounting for exploit availability and remediation level
temporal score
The impact on confidentiality: none, low, or high.
The impact on confidentiality if the vulnerability is exploited
impact on confidentiality
The package name within the specified ecosystem affected by this vulnerability range. Maps to OSV schema's affected[].package.name field.
The package name within an ecosystem affected by this range
affects package name
The CVSS base score representing the intrinsic severity of the vulnerability, independent of temporal or environmental factors. Range: 0.0 (none) to 10.0 (critical).
The CVSS base score (0.0-10.0)
base score
Associates a patch activity with the specific vulnerabilities that it addresses.
Links a patch activity to the vulnerabilities it fixes
patch addresses
The CVSS environmental score customized for a specific deployment context, considering modified impact metrics and organizational requirements. Optional — typically computed by individual organizations, not present in NVD data.
The CVSS environmental score customized for a specific IT environment
environmental score
A Common Vulnerability Scoring System assessment reified to support multiple CVSS versions (2.0, 3.0, 3.1, 4.0) per vulnerability. NVD routinely provides both CVSS v2 and v3.1 scores — reification allows both to coexist without conflict.
A reified CVSS assessment with version, score, and vector
CVSS Score
DEPRECATED: The full CVSS vector string encoding the vulnerability characteristics. Replaced by the CVSSScore reification.
DEPRECATED: Use hasCVSSScore → CVSSScore → vectorString instead. The flat cvssVector property is not tied to a CVSS version.
CVSS vector
A known security vulnerability in software, identified and tracked using the Common Vulnerabilities and Exposures (CVE) system, including severity scoring and impact assessment.
A known security vulnerability identified by a CVE record. Cross-references SPDX 3.0 Vulnerability concept but models additional OSV-aligned version ranges and provenance chains not present in SPDX.
Vulnerability
The impact on data integrity: none, low, or high.
The impact on data integrity if the vulnerability is exploited
impact on integrity
Associates a vulnerability with a reified affected range that specifies the ecosystem, package name, version range type, and discrete events (introduced/fixed). Maps to OSV schema's affected[].ranges[] structure. Multiple ranges can exist per vulnerability for different ecosystems or version schemes.
Links a vulnerability to an affected version range specification
has affected range
Common Platform Enumeration (CPE) 2.3 identifier linking this package to NVD vulnerability feeds. Format: cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*. Enables cross-referencing with CVE databases.
Common Platform Enumeration identifier for the package
CPE identifier
The version string (for SEMVER/ECOSYSTEM ranges) or git commit hash (for GIT ranges) marking this event. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field values.
The version string or commit hash for this event
event version
Associates a security-patched package version with the prior version from which it was derived, establishing the provenance chain for security updates.
Links a patched package version to the unpatched version it was derived from
patched from
The date when the security advisory was published.
The date the security advisory was published
advisory date
A reified CVE identifier entity that can be shared across vulnerability records and advisories, enabling cross-graph CVE queries without string matching.
A Common Vulnerabilities and Exposures identifier entity, shared across vulnerability and advisory graphs
CVE Identifier
Associates a security advisory with the package it applies to.
Links a security advisory to the package it applies to
advisory for package
The CVSS specification version used to compute this score. Values: 2.0, 3.0, 3.1, 4.0. Different versions use different metrics and produce different scores for the same vulnerability.
The CVSS scoring version (2.0, 3.0, 3.1, or 4.0)
CVSS version
The inverse relationship of affectsVersion, linking a package version to the vulnerabilities it is affected by. Enables efficient 'what CVEs affect this version' queries without scanning all vulnerabilities.
Links a package version to the vulnerabilities that affect it
vulnerable in
DEPRECATED: The Common Vulnerability Scoring System score (0.0-10.0). Replaced by the CVSSScore reification which supports multiple CVSS versions per vulnerability.
DEPRECATED: Use hasCVSSScore to link to a CVSSScore entity instead. The flat cvssScore property cannot represent multiple CVSS versions (v2, v3.1) for the same vulnerability.
CVSS score