access complexity
domain: Vulnerability
comment: The complexity of the attack required to exploit the vulnerability
type: DatatypeProperty
IAO_0000115: The complexity of the attack required to exploit the vulnerability.
range: string

advisory date
domain: Security Advisory
comment: The date the security advisory was published
IAO_0000115: The date when the security advisory was published.
type: DatatypeProperty
range: dateTime

advisory type
comment: The category of advisory
type: ObjectProperty
IAO_0000115: The category of advisory (security, bugfix, or enhancement), as a SKOS concept from sec:AdvisoryCategoryScheme.
range: Concept
domain: Security Advisory

impact score
IAO_0000115: The CVSS impact sub-score.
domain: Vulnerability
comment: The CVSS impact sub-score
type: DatatypeProperty
range: decimal

Package Security Ontology
license: https://creativecommons.org/publicdomain/zero/1.0/
version info: 0.7.0
description: A comprehensive ontology for modeling security vulnerabilities (CVEs), vendor security advisories (RHSA, DSA, GLSA), severity scoring, and their relationships to affected and fixed package versions.
created: 2025-09-05
imports: core#
abstract: The Security ontology models CVE vulnerabilities, vendor security advisories (RHSA, DSA, GLSA), and CVSS severity scores. It links vulnerabilities to affected and fixed package versions, enabling SPARQL queries such as finding all packages in a distribution affected by a given CVE, or listing unpatched vulnerabilities for a release.
comment: Ontology for representing security vulnerabilities, advisories, and their relationships to software packages
creator: packagegraph.github.io
version IRI: https://purl.org/packagegraph/ontology/security/0.7.0
modified: 2026-04-21
prior version: https://purl.org/packagegraph/ontology/security/0.6.0
type: Ontology

Range Event
comment: A discrete event in a vulnerability's affected version range (introduced, fixed, or last_affected)
type: Class
IAO_0000115: A version or commit marker indicating when a vulnerability was introduced into the codebase, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] structure.
subclass of: Thing

Affected Range
IAO_0000115: A reified affected range entity that associates a vulnerability with an ecosystem, package name, version range type (SEMVER/ECOSYSTEM/GIT), and discrete range events (introduced/fixed/last_affected). This models the OSV schema's affected[].ranges[] structure, enabling precise version-specific vulnerability queries.
type: Class
subclass of: Thing
comment: A version range specification for packages affected by a vulnerability, following the OSV schema model

affects ecosystem
comment: Links an affected range to the package ecosystem it applies to
domain: Affected Range
type: ObjectProperty
range: Ecosystem
IAO_0000115: Specifies which package ecosystem this affected range applies to (e.g., PyPI, npm, Debian). Maps to OSV schema's affected[].package.ecosystem field.

Vulnerability
subclass of: Thing
comment: A known security vulnerability identified by a CVE record. Cross-references SPDX 3.0 Vulnerability concept but models additional OSV-aligned version ranges and provenance chains not present in SPDX.
subclass of: Restriction
  cardinality: 1
  on property: CVE identifier
IAO_0000115: A known security vulnerability in software, identified and tracked using the Common Vulnerabilities and Exposures (CVE) system, including severity scoring and impact assessment.
type: Class

published date
comment: The date the vulnerability was publicly disclosed
domain: Vulnerability
range: dateTime
type: DatatypeProperty
IAO_0000115: The date when the vulnerability was publicly disclosed.

CPE identifier
type: DatatypeProperty
IAO_0000115: Common Platform Enumeration (CPE) 2.3 identifier linking this package to NVD vulnerability feeds. Format: cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*. Enables cross-referencing with CVE databases.
comment: Common Platform Enumeration identifier for the package
range: string
domain: PackageIdentity

affects package name
type: DatatypeProperty
range: string
domain: Affected Range
IAO_0000115: The package name within the specified ecosystem affected by this vulnerability range. Maps to OSV schema's affected[].package.name field.
comment: The package name within an ecosystem affected by this range

impact on confidentiality
type: DatatypeProperty
range: string
IAO_0000115: The impact on confidentiality: none, low, or high.
comment: The impact on confidentiality if the vulnerability is exploited
domain: Vulnerability

CVSS version
domain: CVSS Score
comment: The CVSS scoring version (2.0, 3.0, 3.1, or 4.0)
IAO_0000115: The CVSS specification version used to compute this score. Values: 2.0, 3.0, 3.1, 4.0. Different versions use different metrics and produce different scores for the same vulnerability.
range: string
type: DatatypeProperty

event version
IAO_0000115: The version string (for SEMVER/ECOSYSTEM ranges) or git commit hash (for GIT ranges) marking this event. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field values.
type: DatatypeProperty
range: string
domain: Range Event
comment: The version string or commit hash for this event

CVSS score
type: DatatypeProperty
range: decimal
IAO_0000115: DEPRECATED: The Common Vulnerability Scoring System score (0.0-10.0). Replaced by the CVSSScore reification which supports multiple CVSS versions per vulnerability.
domain: Vulnerability
comment: DEPRECATED: Use hasCVSSScore to link to a CVSSScore entity instead. The flat cvssScore property cannot represent multiple CVSS versions (v2, v3.1) for the same vulnerability.
deprecated: true

access vector
domain: Vulnerability
IAO_0000115: The attack vector: network, adjacent, local, or physical.
comment: The attack vector for the vulnerability
type: DatatypeProperty
range: string

summary
range: string
comment: A human-readable summary of the vulnerability
IAO_0000115: A human-readable description of the vulnerability.
domain: Vulnerability
type: DatatypeProperty

affects version
type: ObjectProperty
inverse of: vulnerable in
domain: Vulnerability
comment: Links a vulnerability to the package versions it affects
range: Version
IAO_0000115: Associates a vulnerability with the package versions it affects.

has CVSS score
comment: Links a vulnerability to a reified CVSS assessment
type: ObjectProperty
IAO_0000115: Associates a vulnerability with a CVSS score entity. Multiple scores can exist per vulnerability for different CVSS versions (2.0, 3.0, 3.1, 4.0). NVD routinely provides both CVSS v2 and v3.1 — reification allows both to coexist.
domain: Vulnerability
range: CVSS Score

has range event
domain: Affected Range
IAO_0000115: Associates an affected range with version or commit markers indicating when a vulnerability was introduced, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] array.
comment: Links an affected range to a discrete event marking when the vulnerability was introduced, fixed, or last affected
type: ObjectProperty
range: Range Event

updated date
IAO_0000115: The date when the vulnerability record was last modified.
range: dateTime
comment: The date the vulnerability record was last modified
type: DatatypeProperty
domain: Vulnerability

patch addresses
IAO_0000115: Associates a patch activity with the specific vulnerabilities that it addresses.
comment: Links a patch activity to the vulnerabilities it fixes
range: Vulnerability
domain: Patch Activity
type: ObjectProperty

affects package
inverse of: has vulnerability report
type: ObjectProperty
comment: Convenience shortcut linking a vulnerability directly to an affected package identity. IMPRECISE: This property links to the PackageIdentity (all versions) without specifying affected version ranges. For version-specific vulnerability queries, use hasAffectedRange instead. Useful for quick 'is this package name affected?' queries but produces false positives if the package has been patched in some versions.
range: PackageIdentity
IAO_0000115: Associates a vulnerability directly with an affected package identity, bypassing version-string joins for direct package-level queries. This is a convenience shortcut that trades precision for query simplicity.
domain: Vulnerability

event type
comment: The type of range event: introduced, fixed, or last_affected
IAO_0000115: Indicates whether this event marks when the vulnerability was introduced into the codebase, when it was fixed, or the last known affected version, as a SKOS concept from sec:EventTypeScheme. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field names.
type: ObjectProperty
domain: Range Event
range: Concept

fixed in version
range: Version
comment: Links a vulnerability to the package version containing its fix
IAO_0000115: Associates a vulnerability with the package version that contains its fix.
type: ObjectProperty
domain: Vulnerability

impact on availability
comment: The impact on system availability if the vulnerability is exploited
type: DatatypeProperty
range: string
IAO_0000115: The impact on system availability: none, low, or high.
domain: Vulnerability

exploitability score
domain: Vulnerability
IAO_0000115: The CVSS exploitability sub-score.
comment: The CVSS exploitability sub-score
type: DatatypeProperty
range: decimal

CVE Identifier
type: Class
subclass of: Thing
comment: A Common Vulnerabilities and Exposures identifier entity, shared across vulnerability and advisory graphs
IAO_0000115: A reified CVE identifier entity that can be shared across vulnerability records and advisories, enabling cross-graph CVE queries without string matching.

advisory identifier
domain: Security Advisory
type: FunctionalProperty
range: string
comment: The unique identifier for the security advisory
type: DatatypeProperty
IAO_0000115: The unique identifier for the security advisory.

has CWE
type: ObjectProperty
domain: Vulnerability
comment: Links a vulnerability to a CWE weakness category entity
IAO_0000115: Associates a vulnerability with a Common Weakness Enumeration category entity, enabling classification and analysis of vulnerability types.

temporal score
IAO_0000115: The CVSS temporal score adjusting the base score based on current exploit code maturity, remediation level, and report confidence. Optional — not all assessments include temporal scoring.
domain: CVSS Score
type: DatatypeProperty
range: decimal
comment: The CVSS temporal score accounting for exploit availability and remediation level

base score
type: DatatypeProperty
IAO_0000115: The CVSS base score representing the intrinsic severity of the vulnerability, independent of temporal or environmental factors. Range: 0.0 (none) to 10.0 (critical).
comment: The CVSS base score (0.0-10.0)
domain: CVSS Score
range: decimal

impact on integrity
comment: The impact on data integrity if the vulnerability is exploited
domain: Vulnerability
range: string
type: DatatypeProperty
IAO_0000115: The impact on data integrity: none, low, or high.

has vulnerability report
range: Vulnerability
type: ObjectProperty
IAO_0000115: The inverse relationship of affectsPackage, linking a package identity to the vulnerabilities that affect it. Enables efficient 'what CVEs affect this package' queries.
domain: PackageIdentity
comment: Links a package identity to vulnerabilities that affect it

CWE identifier
IAO_0000115: The Common Weakness Enumeration identifier classifying the vulnerability type.
range: string
type: DatatypeProperty
comment: The CWE identifier classifying the vulnerability type
domain: Vulnerability

patch produced version
range: Patch Activity
type: ObjectProperty
comment: Links a fixed package version to the patch activity that produced it
IAO_0000115: Associates a fixed package version with the patch activity that produced it from the prior version.
domain: Version
sub property of: wasGeneratedBy

CVSS vector
type: DatatypeProperty
range: string
IAO_0000115: DEPRECATED: The full CVSS vector string encoding the vulnerability characteristics. Replaced by the CVSSScore reification.
comment: DEPRECATED: Use hasCVSSScore → CVSSScore → vectorString instead. The flat cvssVector property is not tied to a CVSS version.
domain: Vulnerability
deprecated: true

environmental score
type: DatatypeProperty
comment: The CVSS environmental score customized for a specific IT environment
range: decimal
domain: CVSS Score
IAO_0000115: The CVSS environmental score customized for a specific deployment context, considering modified impact metrics and organizational requirements. Optional — typically computed by individual organizations, not present in NVD data.

patched from
range: Version
sub property of: wasDerivedFrom
type: ObjectProperty
IAO_0000115: Associates a security-patched package version with the prior version from which it was derived, establishing the provenance chain for security updates.
domain: Version
comment: Links a patched package version to the unpatched version it was derived from

CVE identifier
IAO_0000115: The unique Common Vulnerabilities and Exposures identifier.
comment: The unique CVE identifier for the vulnerability
type: DatatypeProperty
range: string
domain: Vulnerability

addresses vulnerability
range: Vulnerability
domain: Security Advisory
IAO_0000115: Links a security advisory to the vulnerabilities it addresses.
type: ObjectProperty
comment: Links a security advisory to the vulnerabilities it addresses

Patch Activity
comment: An activity that applies a security patch to produce a fixed package version
subclass of: PackagingActivity
IAO_0000115: A packaging activity that applies one or more security patches to address vulnerabilities, producing a new package version derived from the unpatched version.
type: Class

advisory for package
type: ObjectProperty
domain: Security Advisory
range: Package
IAO_0000115: Associates a security advisory with the package it applies to.
comment: Links a security advisory to the package it applies to

severity
comment: The severity level of the vulnerability
IAO_0000115: The severity classification: low, medium, high, or critical.
type: DatatypeProperty
range: string
domain: Vulnerability

CVE entity
type: ObjectProperty
range: CVE Identifier
comment: Links a vulnerability or advisory to a shared CVE identifier entity
IAO_0000115: Associates a vulnerability or advisory with a reified CVE identifier entity, enabling graph-traversable relationships across all records that reference the same CVE.

OSV identifier
comment: The canonical OSV database identifier for this vulnerability
range: string
IAO_0000115: The canonical Open Source Vulnerability database identifier (e.g., GHSA-xxxx-xxxx-xxxx, PYSEC-2024-xxxx, RUSTSEC-2024-xxxx). Maps to OSV schema's id field. Not all vulnerabilities have CVE identifiers — this is the primary key.
type: DatatypeProperty
domain: Vulnerability

advisory severity
domain: Security Advisory
comment: The overall severity level of the advisory
type: ObjectProperty
range: Concept
IAO_0000115: The overall severity level assigned to the advisory, as a SKOS concept from sec:SeverityScheme.

vulnerable in
range: Vulnerability
type: ObjectProperty
domain: Version
comment: Links a package version to the vulnerabilities that affect it
IAO_0000115: The inverse relationship of affectsVersion, linking a package version to the vulnerabilities it is affected by. Enables efficient 'what CVEs affect this version' queries without scanning all vulnerabilities.

vector string
domain: CVSS Score
IAO_0000115: The complete CVSS vector string encoding attack vector, complexity, privileges required, and impact metrics. Format varies by CVSS version.
type: DatatypeProperty
comment: The full CVSS vector string encoding all metric values
range: string

range type
domain: Affected Range
IAO_0000115: The versioning scheme: SEMVER (semantic versioning), ECOSYSTEM (ecosystem-specific), or GIT (git commit hashes), as a SKOS concept from sec:RangeTypeScheme. Maps to OSV schema's affected[].ranges[].type field.
type: ObjectProperty
comment: The versioning scheme used in this affected range
range: Concept

has affected range
domain: Vulnerability
comment: Links a vulnerability to an affected version range specification
range: Affected Range
IAO_0000115: Associates a vulnerability with a reified affected range that specifies the ecosystem, package name, version range type, and discrete events (introduced/fixed). Maps to OSV schema's affected[].ranges[] structure. Multiple ranges can exist per vulnerability for different ecosystems or version schemes.
type: ObjectProperty

Security Advisory
comment: A vendor security advisory that addresses one or more vulnerabilities
subclass of: Restriction
  cardinality: 1
  on property: advisory identifier
type: Class
IAO_0000115: A vendor-issued security advisory (such as RHSA, DSA, or GLSA) that documents and addresses one or more known vulnerabilities, providing guidance and fixes for affected packages.
subclass of: Thing

CVSS Score
IAO_0000115: A Common Vulnerability Scoring System assessment reified to support multiple CVSS versions (2.0, 3.0, 3.1, 4.0) per vulnerability. NVD routinely provides both CVSS v2 and v3.1 scores — reification allows both to coexist without conflict.
type: Class
subclass of: Thing
comment: A reified CVSS assessment with version, score, and vector