Question 1

What is a vendor security advisory?

Accepted Answer

A vendor security advisory is an official disclosure published by the software or hardware vendor itself — Microsoft's MSRC, Red Hat Product Security, GitHub Security Advisories, and others. Vendor advisories typically include a CVE-ID once one is assigned, vendor-specific remediation steps, and the exact list of affected product builds — all of which the upstream NVD entry may not yet have.

Question 2

How is this different from the NVD CVE feed?

Accepted Answer

NVD publishes CVE records; it does not assign CVE IDs. CVE Numbering Authorities do, and many vendors are CNAs for their own products. This feed reads each vendor's own advisories, including those that name no CVE ID, which a feed keyed on CVE IDs cannot list. We have not measured how much earlier, if at all, a vendor's advisory appears than NVD's record.

Question 3

Which vendors are tracked?

Accepted Answer

10 vendors are live and ingesting today: GitHub Security Advisories (GHSA), Red Hat Product Security (RHSA via CSAF), Microsoft Security Response Center (MSRC), Cisco PSIRT, GitLab, AWS Security Bulletins, Palo Alto Networks, Google Cloud, HashiCorp, and Grafana Labs. OSV, Apple, Azure and Atlassian are registered but not yet ingesting. VMware (VMSA) is registered but dormant — Broadcom retired the public feed after the acquisition and has not replaced it.

Question 4

How often is the feed updated?

Accepted Answer

GitHub GHSA and Cisco PSIRT are polled hourly. Microsoft MSRC, AWS and Google Cloud are polled every two hours, Red Hat CSAF every three, and GitLab, Palo Alto, HashiCorp and Grafana every six. Those are poll floors, not a live stream — an advisory can sit at the vendor for up to one interval before we see it. A poll can also fail: when a vendor's feed has not been collected for three of its intervals, the coverage endpoint (GET /api/v1/public/vendor-advisories/coverage) says so, with collection_state failing and the time of its last successful poll, after which that vendor's advisories may not be held. When the polls succeed but some of the documents a vendor lists cannot be used for six hours, it says partial instead, with how many are held back and since when: those may not be held, the rest are. Each advisory's first-seen timestamp is preserved separately from the vendor's published-at so you can audit how quickly we caught it.

Question 5

Does the feed include CVSS scores and remediation guidance?

Accepted Answer

Yes when the vendor publishes them. CVSS v3 scores, severity bands (Critical/High/Medium/Low), the full list of affected product builds, vendor-specific patch / mitigation steps, and authoritative reference URLs are surfaced on every advisory detail page. Fields are blank when the vendor's own disclosure did not include them.

Question 6

Is this feed free to use?

Accepted Answer

Yes. All pages on /pulse/vendor-advisories are free to read and link to. The underlying advisory data is published by each vendor under their own terms — EchelonGraph aggregates and normalises it for discoverability.

Vendor Security Advisories

Get vendor-disclosed advisories by email

Browse by vendor

Browse all advisories

Frequently asked questions