GitHub Security Advisories Scraper

GitHub Security Advisories Scraper

Scrape GitHub Security Advisories (GHSA) by ecosystem, severity, CVE, or package, up to a million per run. Every advisory comes with its CVE ID, CVSS score, EPSS, affected packages, and patched versions. No API key required. Export to CSV, JSON, Excel, or XML.

GitHub's official API needs a token and rate-limits you to 60 requests per hour. This reads the public GHSA feed directly, filtered by severity, ecosystem, CVE, or affected package, and returns each advisory in one fixed schema. Track vulnerabilities in npm, pip, Maven, Go, and more without writing a single line of code.

Who uses it	What they scrape GitHub Security Advisories for
Security engineers	Monitor new vulnerabilities in the open-source packages their product depends on
DevSecOps teams	Feed GHSA data into internal ticketing or SIEM systems for triage
Compliance officers	Maintain an audit trail of advisories affecting their software supply chain
Researchers	Analyze vulnerability trends across ecosystems and severity levels

What it does

This Actor collects GitHub Security Advisories by ecosystem, severity, CVE ID, or affected package, and returns each one as a flat row with its CVE, CVSS, EPSS, and affected package details.

• 🔍 CVE lookup: Pass an exact CVE ID like CVE-2024-12345 and get the matching advisory.
• 📦 Package filter: Use 'npm/lodash' or a comma-separated list to find advisories affecting specific packages.
• 📅 Date range: Set published-from and published-to dates to capture only new advisories since your last run.
• 📊 EPSS sorting: Sort by EPSS percentage or percentile to prioritize the vulnerabilities most likely to be exploited.
• 🔑 Optional token: Add a GitHub personal access token to raise the rate limit from 60 to 5,000 requests per hour for large pulls.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with GitHub Security Advisories data

🛡️ Monitor your dependency tree.

A security engineer runs the Actor weekly with the 'affects' filter set to their package list, then exports the new advisories to a Slack alert.

📈 Track vulnerability trends.

A researcher collects all critical advisories for the npm ecosystem over a year and plots severity and EPSS trends to spot risky package categories.

🧾 Build a compliance report.

A compliance officer pulls all reviewed advisories affecting their organization's software and generates an audit-ready CSV for regulators.

🔎 Investigate a specific CVE.

An incident responder enters a CVE ID from a scanner alert and gets the full advisory with affected versions and patched releases in seconds.

Why choose this scraper

	What you get
No API key	Works anonymously out of the box, no registration or token needed
Fixed schema	Every advisory returns the same flat fields, ready for CSV or database import
Up to 1M rows	Collect a million advisories per run, enough for historical analysis
EPSS included	Exploit Prediction Scoring System data helps you prioritize real-world risk

How it compares

No other Store actor targets GitHub Security Advisories the same way, so the honest comparison is with the alternatives teams actually weigh.

	GitHub Security Advisories Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When GitHub Security Advisories changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor from advisory type, severity, ecosystem, CVE ID, affected package, and publication date range, alone or together, and filters run as each advisory is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
 "maxItems": 10
}

A larger pull:

{
 "maxItems": 200
}

Pricing

Pay-per-result: $0.021 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$2.10
1,000 results	$21.00
10,000 results	$210.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the GitHub Security Advisories Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to GitHub Security Advisories through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/github-security-advisories-ghsa-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results?

Check your filters. The 'affects' field requires the format 'ecosystem/name' (e.g. 'npm/lodash'). Also verify that your date range is correct and that the CVE ID is exact.

Why did the run stop after 60 requests?

You hit the anonymous rate limit. Add a GitHub personal access token in the 'ghToken' field to raise the limit to 5,000 requests per hour.

Why is my CVE ID not found?

The CVE may not be in the GitHub Security Advisories database, or it may be unreviewed. Try searching without the CVE filter and use the 'affects' or 'ecosystem' filters instead.

Why are some advisories missing EPSS scores?

EPSS scores are not available for all advisories, especially very new or unreviewed ones. Sort by EPSS only if you need to prioritize, and expect some null values.

FAQ

Question	Answer
Do I need a GitHub token to use this Actor?	No. The Actor works anonymously with a rate limit of 60 requests per hour. If you need to collect more than a few hundred advisories per run, add a personal access token to raise the limit to 5,000 requests per hour.
What is the difference between reviewed, malware, and unreviewed advisories?	Reviewed advisories are curated by GitHub and have a CVE ID. Malware advisories report malicious packages. Unreviewed advisories are community-submitted and may not have a CVE yet.
Can I filter by a specific package like lodash?	Yes. Use the 'affects' field with the format 'ecosystem/name', for example 'npm/lodash'. You can also pass a comma-separated list to match multiple packages.
Does this Actor return EPSS scores?	Yes. Each advisory includes EPSS percentage and percentile, and you can sort by either field to prioritize vulnerabilities that are more likely to be exploited.
What output formats are supported?	You can export the results to CSV, JSON, Excel, or XML directly from the Apify dataset.
How do I get only new advisories since my last run?	Set the 'published from' date to the day after your last run. The Actor will return only advisories published on or after that date.
Can I search by CVE ID?	Yes. Enter the exact CVE identifier, like CVE-2024-12345, in the 'CVE ID' field and the Actor will return the matching advisory.
Is there a limit on how many advisories I can collect?	You can set 'maxItems' up to 1,000,000 per run. The actual number returned depends on the filters you apply.
Does this Actor work with private GitHub repositories?	No. It only reads the public GitHub Security Advisories feed. Private repository advisories are not accessible.
What ecosystems are supported?	npm, pip, Maven, Go, NuGet, RubyGems, Cargo, Composer, Pub, Swift, GitHub Actions, Erlang/Elixir, and Other.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by GitHub, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.