About
Data sources and attribution
DVSentry matches the software it finds in your repositories, container images, cloud hosts and Kubernetes clusters against public vulnerability data. This page lists where that data comes from, the licence each publisher gives it, and the open-source tools that read it. We use these sources as published; DVSentry does not sell or redistribute the databases.
National Vulnerability Database notice
This product uses data from the NVD API but is not endorsed or certified by the NVD. NVD data is published by the U.S. National Institute of Standards and Technology. Where DVSentry combines NVD data with other sources or adds its own priority, the result is DVSentry's and is not NVD data.
Vulnerability data
- National Vulnerability Database (NVD), NIST: U.S. government data, used under the NVD terms of use (see the notice above).
- GitHub Advisory Database, GitHub, Inc.: licensed under Creative Commons Attribution 4.0 (CC BY 4.0).
- GitLab advisories (advisories-community), GitLab Inc.: MIT licence.
- Red Hat security data (OVAL, CSAF and VEX), Red Hat, Inc.: licensed under CC BY 4.0.
- Ubuntu security notices and CVE tracker, Canonical Ltd.: licensed under Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0). DVSentry uses the data and does not publish an adapted copy of it.
- OSV.dev, Google and the Open Source Security Foundation: the service and schema under the Apache License 2.0; each record carries the licence of the source it came from. This includes the OpenSSF malicious-packages data set (Apache License 2.0).
- Go vulnerability database (vuln.go.dev), the Go project: CC BY 4.0.
- Distribution security data published for public use by each project: the Debian security tracker, Alpine secdb, Amazon Linux security advisories (ALAS), Rocky Linux and AlmaLinux errata, SUSE CVRF, Oracle Linux OVAL, VMware Photon OS and Wolfi.
- CISA Known Exploited Vulnerabilities catalog, U.S. Cybersecurity and Infrastructure Security Agency: U.S. government data.
- Exploit Prediction Scoring System (EPSS), FIRST.org: used with attribution as FIRST asks. See first.org/epss.
Open-source tools that read this data
- Trivy and its vulnerability database builder, Aqua Security: Apache License 2.0.
- Grype and its database, Anchore, Inc.: Apache License 2.0.
- govulncheck, the Go project: BSD 3-Clause licence.
- Sigstore (sigstore-python, Cosign): Apache License 2.0.
Every tool DVSentry runs is under a free, open-source licence. The full list of scanners, with their versions and licences, is in the scanner manifest published with each signed scanner image.
Cloud and host data
For the Infrastructure pillar, DVSentry reads the package inventory that your cloud provider's own guest agent already collected (AWS Systems Manager Inventory, Google Cloud VM Manager OS inventory, Azure Update Manager assessments), with the read-only access your organization grants. That inventory is your data; it is matched against the sources above and is never shared.
Configuration checks
DVSentry's Kubernetes node checks and host configuration checks are written by DVSentry in its own words. They point to the Kubernetes documentation and to the NSA and CISA Kubernetes Hardening Guide (a U.S. government publication). They are not CIS Benchmarks, do not reproduce CIS Benchmark text, and DVSentry is not affiliated with or endorsed by the Center for Internet Security.
Corrections
If you publish one of these sources and want the attribution changed, or you find a mistake on this page, write to security@dvsentry.com.