Question 1

What is a vendor security advisory?

Accepted Answer

A vendor security advisory is an official disclosure published by the software or hardware vendor itself — Microsoft's MSRC, Red Hat Product Security, GitHub Security Advisories, and others. Vendor advisories typically include a CVE-ID once one is assigned, vendor-specific remediation steps, and the exact list of affected product builds — all of which the upstream NVD entry may not yet have.

Question 2

How is this different from the NVD CVE feed?

Accepted Answer

NVD publishes CVEs after the CVE Numbering Authority coordinates disclosure with the vendor. Vendors often notify customers days to weeks before NVD's public record. This feed captures the vendor side directly, surfacing embargo-window disclosures that don't yet appear in NVD or GitHub Advisory Database.

Question 3

Which vendors are tracked?

Accepted Answer

Ten vendors are live and ingesting today: GitHub Security Advisories (GHSA), Red Hat Product Security (RHSA via CSAF), Microsoft Security Response Center (MSRC), Cisco PSIRT, GitLab, AWS Security Bulletins, Palo Alto Networks, Google Cloud, HashiCorp, and Grafana Labs. OSV, Apple, Azure and Atlassian are registered but not yet ingesting. VMware (VMSA) is registered but dormant — Broadcom retired the public feed after the acquisition and has not replaced it.

Question 4

How often is the feed updated?

Accepted Answer

GitHub GHSA and Cisco PSIRT are polled hourly for fast embargo-window coverage. Microsoft MSRC, AWS and Google Cloud are polled every two hours, Red Hat CSAF every three, and GitLab, Palo Alto, HashiCorp and Grafana every six. Those are poll floors, not a live stream — an advisory can sit at the vendor for up to one interval before we see it. Each advisory's first-seen timestamp is preserved separately from the vendor's published-at so you can audit how quickly we caught it.

Question 5

Does the feed include CVSS scores and remediation guidance?

Accepted Answer

Yes when the vendor publishes them. CVSS v3 scores, severity bands (Critical/High/Medium/Low), the full list of affected product builds, vendor-specific patch / mitigation steps, and authoritative reference URLs are surfaced on every advisory detail page. Fields are blank when the vendor's own disclosure did not include them.

Question 6

Is this feed free to use?

Accepted Answer

Yes. All pages on /pulse/vendor-advisories are free to read and link to. The underlying advisory data is published by each vendor under their own terms — EchelonGraph aggregates and normalises it for discoverability.

Vendor Security Advisories

Catch vendor-disclosed advisories the day they ship

Browse by vendor

Browse all advisories

Frequently asked questions