access complexity
The category of advisory
The CVSS impact sub-score.
Range Event
A reified affected range entity that associates a vulnerability with an ecosystem, package name, version range type (SEMVER/ECOSYSTEM/GIT), and discrete range events (introduced/fixed/last_affected). This models the OSV schema's affected[].ranges[] structure, enabling precise version-specific vulnerability queries.
The date the security advisory was published
Links an affected range to the package ecosystem it applies to
The date the vulnerability was publicly disclosed
The date when the security advisory was published.
impact on confidentiality
advisory date
The CVSS scoring version (2.0, 3.0, 3.1, or 4.0)
The version string (for SEMVER/ECOSYSTEM ranges) or git commit hash (for GIT ranges) marking this event. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field values.
Package Security Ontology
impact score
Links a vulnerability to a reified CVSS assessment
A comprehensive ontology for modeling security vulnerabilities (CVEs), vendor security advisories (RHSA, DSA, GLSA), severity scoring, and their relationships to affected and fixed package versions.
The date when the vulnerability record was last modified.
affects package name
Associates a patch activity with the specific vulnerabilities that it addresses.
The type of range event: introduced, fixed, or last_affected
impact on availability
CVE Identifier
The impact on system availability if the vulnerability is exploited
The CVSS temporal score adjusting the base score based on current exploit code maturity, remediation level, and report confidence. Optional — not all assessments include temporal scoring.
base score
Common Platform Enumeration (CPE) 2.3 identifier linking this package to NVD vulnerability feeds. Format: cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*. Enables cross-referencing with CVE databases.
The impact on data integrity if the vulnerability is exploited
CWE identifier
environmental score
published date
A human-readable summary of the vulnerability
Indicates whether this event marks when the vulnerability was introduced into the codebase, when it was fixed, or the last known affected version, as a SKOS concept from sec:EventTypeScheme. Maps to OSV schema's affected[].ranges[].events[].{introduced|fixed|last_affected} field names.
The unique Common Vulnerabilities and Exposures identifier.
event type
Links a vulnerability to the package version containing its fix
has range event
A human-readable description of the vulnerability.
has CWE
CVSS version
The category of advisory (security, bugfix, or enhancement), as a SKOS concept from sec:AdvisoryCategoryScheme.
The attack vector: network, adjacent, local, or physical.
Links a patch activity to the vulnerabilities it fixes
The severity level of the vulnerability
Associates a vulnerability with the package version that contains its fix.
The unique CVE identifier for the vulnerability
Associates an affected range with version or commit markers indicating when a vulnerability was introduced, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] array.
The Security ontology models CVE vulnerabilities, vendor security advisories (RHSA, DSA, GLSA), and CVSS severity scores. It links vulnerabilities to affected and fixed package versions, enabling SPARQL queries such as finding all packages in a distribution affected by a given CVE, or listing unpatched vulnerabilities for a release.
addresses vulnerability
Links an affected range to a discrete event marking when the vulnerability was introduced, fixed, or last affected
A discrete event in a vulnerability's affected version range (introduced, fixed, or last_affected)
affects ecosystem
The canonical OSV database identifier for this vulnerability
The CVSS exploitability sub-score.
Patch Activity
advisory type
Ontology for representing security vulnerabilities, advisories, and their relationships to software packages
The Common Weakness Enumeration identifier classifying the vulnerability type.
The CVSS specification version used to compute this score. Values: 2.0, 3.0, 3.1, 4.0. Different versions use different metrics and produce different scores for the same vulnerability.
updated date
has CVSS score
A known security vulnerability identified by a CVE record. Cross-references SPDX 3.0 Vulnerability concept but models additional OSV-aligned version ranges and provenance chains not present in SPDX.
DEPRECATED: The Common Vulnerability Scoring System score (0.0-10.0). Replaced by the CVSSScore reification which supports multiple CVSS versions per vulnerability.
The inverse relationship of affectsPackage, linking a package identity to the vulnerabilities that affect it. Enables efficient 'what CVEs affect this package' queries.
The impact on system availability: none, low, or high.
A vendor security advisory that addresses one or more vulnerabilities
Convenience shortcut linking a vulnerability directly to an affected package identity. IMPRECISE: This property links to the PackageIdentity (all versions) without specifying affected version ranges. For version-specific vulnerability queries, use hasAffectedRange instead. Useful for quick 'is this package name affected?' queries but produces false positives if the package has been patched in some versions.
The severity classification: low, medium, high, or critical.
The CVSS exploitability sub-score
An activity that applies a security patch to produce a fixed package version
The date the vulnerability record was last modified
A version or commit marker indicating when a vulnerability was introduced into the codebase, when it was fixed, or the last known affected version. Maps to OSV schema's affected[].ranges[].events[] structure.
DEPRECATED: The full CVSS vector string encoding the vulnerability characteristics. Replaced by the CVSSScore reification.
The attack vector for the vulnerability
CPE identifier
The overall severity level of the advisory
Links a vulnerability or advisory to a shared CVE identifier entity
A Common Vulnerability Scoring System assessment reified to support multiple CVSS versions (2.0, 3.0, 3.1, 4.0) per vulnerability. NVD routinely provides both CVSS v2 and v3.1 scores — reification allows both to coexist without conflict.
range type
The complete CVSS vector string encoding attack vector, complexity, privileges required, and impact metrics. Format varies by CVSS version.
A packaging activity that applies one or more security patches to address vulnerabilities, producing a new package version derived from the unpatched version.
affects version
patch addresses
DEPRECATED: Use hasCVSSScore → CVSSScore → vectorString instead. The flat cvssVector property is not tied to a CVSS version.
CVE entity
A vendor-issued security advisory (such as RHSA, DSA, or GLSA) that documents and addresses one or more known vulnerabilities, providing guidance and fixes for affected packages.
impact on integrity
vulnerable in
Links a vulnerability to the package versions it affects
CVSS score
Links a security advisory to the vulnerabilities it addresses.
The CWE identifier classifying the vulnerability type
The CVSS base score representing the intrinsic severity of the vulnerability, independent of temporal or environmental factors. Range: 0.0 (none) to 10.0 (critical).
Common Platform Enumeration identifier for the package
The CVSS base score (0.0-10.0)
advisory for package
patch produced version
vector string
The complexity of the attack required to exploit the vulnerability
access vector
Associates a vulnerability directly with an affected package identity, bypassing version-string joins for direct package-level queries. This is a convenience shortcut that trades precision for query simplicity.
Associates a vulnerability with a CVSS score entity. Multiple scores can exist per vulnerability for different CVSS versions (2.0, 3.0, 3.1, 4.0). NVD routinely provides both CVSS v2 and v3.1 — reification allows both to coexist.
The package name within the specified ecosystem affected by this vulnerability range. Maps to OSV schema's affected[].package.name field.
has affected range
The impact on confidentiality: none, low, or high.
Security Advisory
fixed in version
has vulnerability report
temporal score
Affected Range
Associates a vulnerability or advisory with a reified CVE identifier entity, enabling graph-traversable relationships across all records that reference the same CVE.
exploitability score
Links a vulnerability to an affected version range specification
CVSS Score
The date when the vulnerability was publicly disclosed.
Associates a security-patched package version with the prior version from which it was derived, establishing the provenance chain for security updates.
summary
The CVSS environmental score customized for a specific IT environment
The versioning scheme: SEMVER (semantic versioning), ECOSYSTEM (ecosystem-specific), or GIT (git commit hashes), as a SKOS concept from sec:RangeTypeScheme. Maps to OSV schema's affected[].ranges[].type field.
Links a vulnerability to a CWE weakness category entity
A Common Vulnerabilities and Exposures identifier entity, shared across vulnerability and advisory graphs
event version
Associates a vulnerability with a Common Weakness Enumeration category entity, enabling classification and analysis of vulnerability types.
patched from
The full CVSS vector string encoding all metric values
advisory severity
CVSS vector
The overall severity level assigned to the advisory, as a SKOS concept from sec:SeverityScheme.
Links a patched package version to the unpatched version it was derived from
advisory identifier
The unique identifier for the security advisory
DEPRECATED: Use hasCVSSScore to link to a CVSSScore entity instead. The flat cvssScore property cannot represent multiple CVSS versions (v2, v3.1) for the same vulnerability.
Vulnerability
The complexity of the attack required to exploit the vulnerability.
Links a fixed package version to the patch activity that produced it
OSV identifier
A version range specification for packages affected by a vulnerability, following the OSV schema model
The version string or commit hash for this event
The versioning scheme used in this affected range
The impact on confidentiality if the vulnerability is exploited
Associates a vulnerability with a reified affected range that specifies the ecosystem, package name, version range type, and discrete events (introduced/fixed). Maps to OSV schema's affected[].ranges[] structure. Multiple ranges can exist per vulnerability for different ecosystems or version schemes.
A known security vulnerability in software, identified and tracked using the Common Vulnerabilities and Exposures (CVE) system, including severity scoring and impact assessment.
The package name within an ecosystem affected by this range
The canonical Open Source Vulnerability database identifier (e.g., GHSA-xxxx-xxxx-xxxx, PYSEC-2024-xxxx, RUSTSEC-2024-xxxx). Maps to OSV schema's id field. Not all vulnerabilities have CVE identifiers — this is the primary key.
affects package
Associates a fixed package version with the patch activity that produced it from the prior version.
The unique identifier for the security advisory.
Links a package version to the vulnerabilities that affect it
CVE identifier
A reified CVSS assessment with version, score, and vector
Specifies which package ecosystem this affected range applies to (e.g., PyPI, npm, Debian). Maps to OSV schema's affected[].package.ecosystem field.
The inverse relationship of affectsVersion, linking a package version to the vulnerabilities it is affected by. Enables efficient 'what CVEs affect this version' queries without scanning all vulnerabilities.
Links a package identity to vulnerabilities that affect it
The CVSS impact sub-score
The CVSS environmental score customized for a specific deployment context, considering modified impact metrics and organizational requirements. Optional — typically computed by individual organizations, not present in NVD data.
A reified CVE identifier entity that can be shared across vulnerability records and advisories, enabling cross-graph CVE queries without string matching.
The impact on data integrity: none, low, or high.
severity
Associates a security advisory with the package it applies to.
Links a security advisory to the package it applies to
The CVSS temporal score accounting for exploit availability and remediation level
Links a security advisory to the vulnerabilities it addresses
Associates a vulnerability with the package versions it affects.