Package Security Ontology
type: Ontology
abstract: The Security ontology models CVE vulnerabilities, vendor security advisories (RHSA, DSA, GLSA), and CVSS severity scores. It links vulnerabilities to affected and fixed package versions, enabling SPARQL queries such as finding all packages in a distribution affected by a given CVE, or listing unpatched vulnerabilities for a release.
created: 2025-09-05
creator: packagegraph.github.io
description: A comprehensive ontology for modeling security vulnerabilities (CVEs), vendor security advisories (RHSA, DSA, GLSA), severity scoring, and their relationships to affected and fixed package versions.
license: https://creativecommons.org/publicdomain/zero/1.0/
modified: 2026-04-21
comment: Ontology for representing security vulnerabilities, advisories, and their relationships to software packages
imports: core#
prior version: https://purl.org/packagegraph/ontology/security/0.6.0
version IRI: https://purl.org/packagegraph/ontology/security/0.7.0
version info: 0.7.0

published date
type: DatatypeProperty
IAO_0000115: The date when the vulnerability was publicly disclosed.
comment: The date the vulnerability was publicly disclosed
domain: Vulnerability
range: dateTime

range type
type: ObjectProperty
IAO_0000115: The versioning scheme: SEMVER (semantic versioning), ECOSYSTEM (ecosystem-specific), or GIT (git commit hashes), as a SKOS concept from sec:RangeTypeScheme. Maps to OSV schema's affected[].ranges[].type field.
comment: The versioning scheme used in this affected range
domain: Affected Range
range: Concept

fixed in version
type: ObjectProperty
IAO_0000115: Associates a vulnerability with the package version that contains its fix.
comment: Links a vulnerability to the package version containing its fix
domain: Vulnerability
range: Version

impact on availability
type: DatatypeProperty
IAO_0000115: The impact on system availability: none, low, or high.
comment: The impact on system availability if the vulnerability is exploited
domain: Vulnerability
range: string

patch produced version
type: ObjectProperty
IAO_0000115: Associates a fixed package version with the patch activity that produced it from the prior version.
comment: Links a fixed package version to the patch activity that produced it
domain: Version
range: Patch Activity
sub property of: wasGeneratedBy

CVE identifier
type: DatatypeProperty
IAO_0000115: The unique Common Vulnerabilities and Exposures identifier.
comment: The unique CVE identifier for the vulnerability
domain: Vulnerability
range: string

vector string
type: DatatypeProperty
IAO_0000115: The complete CVSS vector string encoding attack vector, complexity, privileges required, and impact metrics. Format varies by CVSS version.
comment: The full CVSS vector string encoding all metric values
domain: CVSS Score
range: string

updated date
type: DatatypeProperty
IAO_0000115: The date when the vulnerability record was last modified.
comment: The date the vulnerability record was last modified
domain: Vulnerability
range: dateTime

access complexity
type: DatatypeProperty
IAO_0000115: The complexity of the attack required to exploit the vulnerability.
comment: The complexity of the attack required to exploit the vulnerability
domain: Vulnerability
range: string

has CVSS score
type: ObjectProperty
IAO_0000115: Associates a vulnerability with a CVSS score entity. Multiple scores can exist per vulnerability for different CVSS versions (2.0, 3.0, 3.1, 4.0). NVD routinely provides both CVSS v2 and v3.1 — reification allows both to coexist.
comment: Links a vulnerability to a reified CVSS assessment
domain: Vulnerability
range: CVSS Score

has CWE
type: ObjectProperty
IAO_0000115: Associates a vulnerability with a Common Weakness Enumeration category entity, enabling classification and analysis of vulnerability types.
comment: Links a vulnerability to a CWE weakness category entity
domain: Vulnerability

severity
type: DatatypeProperty
IAO_0000115: The severity classification: low, medium, high, or critical.
comment: The severity level of the vulnerability
domain: Vulnerability
range: string

affects package
type: ObjectProperty
IAO_0000115: Associates a vulnerability directly with an affected package identity, bypassing version-string joins for direct package-level queries. This is a convenience shortcut that trades precision for query simplicity.
comment: Convenience shortcut linking a vulnerability directly to an affected package identity. IMPRECISE: This property links to the PackageIdentity (all versions) without specifying affected version ranges. For version-specific vulnerability queries, use hasAffectedRange instead. Useful for quick 'is this package name affected?' queries but produces false positives if the package has been patched in some versions.
domain: Vulnerability
range: PackageIdentity
inverse of: has vulnerability report

has range event
type: ObjectProperty
IAO_0000115: Associates an affected range with version or commit markers indicating when a vulnerability was introduced, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] array.
comment: Links an affected range to a discrete event marking when the vulnerability was introduced, fixed, or last affected
domain: Affected Range
range: Range Event

Affected Range
type: Class
IAO_0000115: A reified affected range entity that associates a vulnerability with an ecosystem, package name, version range type (SEMVER/ECOSYSTEM/GIT), and discrete range events (introduced/fixed/last_affected). This models the OSV schema's affected[].ranges[] structure, enabling precise version-specific vulnerability queries.
comment: A version range specification for packages affected by a vulnerability, following the OSV schema model
subclass of: Thing

summary
type: DatatypeProperty
IAO_0000115: A human-readable description of the vulnerability.
comment: A human-readable summary of the vulnerability
domain: Vulnerability
range: string

advisory identifier
type: DatatypeProperty
type: FunctionalProperty
IAO_0000115: The unique identifier for the security advisory.
comment: The unique identifier for the security advisory
domain: Security Advisory
range: string

Security Advisory
type: Class
IAO_0000115: A vendor-issued security advisory (such as RHSA, DSA, or GLSA) that documents and addresses one or more known vulnerabilities, providing guidance and fixes for affected packages.
comment: A vendor security advisory that addresses one or more vulnerabilities
subclass of: Restriction
  cardinality: 1
  on property: advisory identifier
subclass of: Thing

has vulnerability report
type: ObjectProperty
IAO_0000115: The inverse relationship of affectsPackage, linking a package identity to the vulnerabilities that affect it. Enables efficient 'what CVEs affect this package' queries.
comment: Links a package identity to vulnerabilities that affect it
domain: PackageIdentity
range: Vulnerability

exploitability score
type: DatatypeProperty
IAO_0000115: The CVSS exploitability sub-score.
comment: The CVSS exploitability sub-score
domain: Vulnerability
range: decimal

impact score
type: DatatypeProperty
IAO_0000115: The CVSS impact sub-score.
comment: The CVSS impact sub-score
domain: Vulnerability
range: decimal

affects ecosystem
type: ObjectProperty
IAO_0000115: Specifies which package ecosystem this affected range applies to (e.g., PyPI, npm, Debian). Maps to OSV schema's affected[].package.ecosystem field.
comment: Links an affected range to the package ecosystem it applies to
domain: Affected Range
range: Ecosystem

CVE entity
type: ObjectProperty
IAO_0000115: Associates a vulnerability or advisory with a reified CVE identifier entity, enabling graph-traversable relationships across all records that reference the same CVE.
comment: Links a vulnerability or advisory to a shared CVE identifier entity
range: CVE Identifier

advisory severity
type: ObjectProperty
IAO_0000115: The overall severity level assigned to the advisory, as a SKOS concept from sec:SeverityScheme.
comment: The overall severity level of the advisory
domain: Security Advisory
range: Concept

advisory type
type: ObjectProperty
IAO_0000115: The category of advisory (security, bugfix, or enhancement), as a SKOS concept from sec:AdvisoryCategoryScheme.
comment: The category of advisory
domain: Security Advisory
range: Concept

access vector
type: DatatypeProperty
IAO_0000115: The attack vector: network, adjacent, local, or physical.
comment: The attack vector for the vulnerability
domain: Vulnerability
range: string

CWE identifier
type: DatatypeProperty
IAO_0000115: The Common Weakness Enumeration identifier classifying the vulnerability type.
comment: The CWE identifier classifying the vulnerability type
domain: Vulnerability
range: string

addresses vulnerability
type: ObjectProperty
IAO_0000115: Links a security advisory to the vulnerabilities it addresses.
comment: Links a security advisory to the vulnerabilities it addresses
domain: Security Advisory
range: Vulnerability

OSV identifier
type: DatatypeProperty
IAO_0000115: The canonical Open Source Vulnerability database identifier (e.g., GHSA-xxxx-xxxx-xxxx, PYSEC-2024-xxxx, RUSTSEC-2024-xxxx). Maps to OSV schema's id field. Not all vulnerabilities have CVE identifiers — this is the primary key.
comment: The canonical OSV database identifier for this vulnerability
domain: Vulnerability
range: string

affects version
type: ObjectProperty
IAO_0000115: Associates a vulnerability with the package versions it affects.
comment: Links a vulnerability to the package versions it affects
domain: Vulnerability
range: Version
inverse of: vulnerable in

Patch Activity
type: Class
IAO_0000115: A packaging activity that applies one or more security patches to address vulnerabilities, producing a new package version derived from the unpatched version.
comment: An activity that applies a security patch to produce a fixed package version
subclass of: PackagingActivity

event type
type: ObjectProperty
IAO_0000115: Indicates whether this event marks when the vulnerability was introduced into the codebase, when it was fixed, or the last known affected version, as a SKOS concept from sec:EventTypeScheme. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field names.
comment: The type of range event: introduced, fixed, or last_affected
domain: Range Event
range: Concept

Range Event
type: Class
IAO_0000115: A version or commit marker indicating when a vulnerability was introduced into the codebase, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] structure.
comment: A discrete event in a vulnerability's affected version range (introduced, fixed, or last_affected)
subclass of: Thing

temporal score
type: DatatypeProperty
IAO_0000115: The CVSS temporal score adjusting the base score based on current exploit code maturity, remediation level, and report confidence. Optional — not all assessments include temporal scoring.
comment: The CVSS temporal score accounting for exploit availability and remediation level
domain: CVSS Score
range: decimal

impact on confidentiality
type: DatatypeProperty
IAO_0000115: The impact on confidentiality: none, low, or high.
comment: The impact on confidentiality if the vulnerability is exploited
domain: Vulnerability
range: string

affects package name
type: DatatypeProperty
IAO_0000115: The package name within the specified ecosystem affected by this vulnerability range. Maps to OSV schema's affected[].package.name field.
comment: The package name within an ecosystem affected by this range
domain: Affected Range
range: string

base score
type: DatatypeProperty
IAO_0000115: The CVSS base score representing the intrinsic severity of the vulnerability, independent of temporal or environmental factors. Range: 0.0 (none) to 10.0 (critical).
comment: The CVSS base score (0.0-10.0)
domain: CVSS Score
range: decimal

patch addresses
type: ObjectProperty
IAO_0000115: Associates a patch activity with the specific vulnerabilities that it addresses.
comment: Links a patch activity to the vulnerabilities it fixes
domain: Patch Activity
range: Vulnerability

environmental score
type: DatatypeProperty
IAO_0000115: The CVSS environmental score customized for a specific deployment context, considering modified impact metrics and organizational requirements. Optional — typically computed by individual organizations, not present in NVD data.
comment: The CVSS environmental score customized for a specific IT environment
domain: CVSS Score
range: decimal

CVSS Score
type: Class
IAO_0000115: A Common Vulnerability Scoring System assessment reified to support multiple CVSS versions (2.0, 3.0, 3.1, 4.0) per vulnerability. NVD routinely provides both CVSS v2 and v3.1 scores — reification allows both to coexist without conflict.
comment: A reified CVSS assessment with version, score, and vector
subclass of: Thing

CVSS vector
type: DatatypeProperty
IAO_0000115: DEPRECATED: The full CVSS vector string encoding the vulnerability characteristics. Replaced by the CVSSScore reification.
comment: DEPRECATED: Use hasCVSSScore → CVSSScore → vectorString instead. The flat cvssVector property is not tied to a CVSS version.
domain: Vulnerability
range: string
deprecated: true

Vulnerability
type: Class
IAO_0000115: A known security vulnerability in software, identified and tracked using the Common Vulnerabilities and Exposures (CVE) system, including severity scoring and impact assessment.
comment: A known security vulnerability identified by a CVE record. Cross-references SPDX 3.0 Vulnerability concept but models additional OSV-aligned version ranges and provenance chains not present in SPDX.
subclass of: Restriction
  cardinality: 1
  on property: CVE identifier
subclass of: Thing

impact on integrity
type: DatatypeProperty
IAO_0000115: The impact on data integrity: none, low, or high.
comment: The impact on data integrity if the vulnerability is exploited
domain: Vulnerability
range: string

has affected range
type: ObjectProperty
IAO_0000115: Associates a vulnerability with a reified affected range that specifies the ecosystem, package name, version range type, and discrete events (introduced/fixed). Maps to OSV schema's affected[].ranges[] structure. Multiple ranges can exist per vulnerability for different ecosystems or version schemes.
comment: Links a vulnerability to an affected version range specification
domain: Vulnerability
range: Affected Range

CPE identifier
type: DatatypeProperty
IAO_0000115: Common Platform Enumeration (CPE) 2.3 identifier linking this package to NVD vulnerability feeds. Format: cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*. Enables cross-referencing with CVE databases.
comment: Common Platform Enumeration identifier for the package
domain: PackageIdentity
range: string

event version
type: DatatypeProperty
IAO_0000115: The version string (for SEMVER/ECOSYSTEM ranges) or git commit hash (for GIT ranges) marking this event. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field values.
comment: The version string or commit hash for this event
domain: Range Event
range: string

patched from
type: ObjectProperty
IAO_0000115: Associates a security-patched package version with the prior version from which it was derived, establishing the provenance chain for security updates.
comment: Links a patched package version to the unpatched version it was derived from
domain: Version
range: Version
sub property of: wasDerivedFrom

advisory date
type: DatatypeProperty
IAO_0000115: The date when the security advisory was published.
comment: The date the security advisory was published
domain: Security Advisory
range: dateTime

CVE Identifier
type: Class
IAO_0000115: A reified CVE identifier entity that can be shared across vulnerability records and advisories, enabling cross-graph CVE queries without string matching.
comment: A Common Vulnerabilities and Exposures identifier entity, shared across vulnerability and advisory graphs
subclass of: Thing

advisory for package
type: ObjectProperty
IAO_0000115: Associates a security advisory with the package it applies to.
comment: Links a security advisory to the package it applies to
domain: Security Advisory
range: Package

CVSS version
type: DatatypeProperty
IAO_0000115: The CVSS specification version used to compute this score. Values: 2.0, 3.0, 3.1, 4.0. Different versions use different metrics and produce different scores for the same vulnerability.
comment: The CVSS scoring version (2.0, 3.0, 3.1, or 4.0)
domain: CVSS Score
range: string

vulnerable in
type: ObjectProperty
IAO_0000115: The inverse relationship of affectsVersion, linking a package version to the vulnerabilities it is affected by. Enables efficient 'what CVEs affect this version' queries without scanning all vulnerabilities.
comment: Links a package version to the vulnerabilities that affect it
domain: Version
range: Vulnerability

CVSS score
type: DatatypeProperty
IAO_0000115: DEPRECATED: The Common Vulnerability Scoring System score (0.0-10.0). Replaced by the CVSSScore reification which supports multiple CVSS versions per vulnerability.
comment: DEPRECATED: Use hasCVSSScore to link to a CVSSScore entity instead. The flat cvssScore property cannot represent multiple CVSS versions (v2, v3.1) for the same vulnerability.
domain: Vulnerability
range: decimal
deprecated: true