Docker Scout Advisory Database Sources and Matching Service

--- description: More details on the advisory database and CVE-to-package matching service behind Docker Scout analysis. keywords: scout, scanning, analysis, vulnerabilities, Hub, supply chain, security, packages, repositories, ecosystem title: Advisory database sources and matching service aliases: /scout/advisory-db-sources/ --- Reliable information sources are key for Docker Scout's ability to surface relevant and accurate assessments of your software artifacts. Given the diversity of sources and methodologies in the industry, discrepancies in vulnerability assessment results can and do happen. This page describes how the Docker Scout advisory database and its CVE-to-package matching approach works to deal with these discrepancies. ## Advisory database sources Docker Scout aggregates vulnerability data from multiple sources. The data is continuously updated to ensure that your security posture is represented using the latest available information, in real-time. Docker Scout uses the following package repositories and security trackers:  - [AlmaLinux Security Advisory](https://errata.almalinux.org/) - [Alpine secdb](https://secdb.alpinelinux.org/) - [Amazon Linux Security Center](https://alas.aws.amazon.com/) - [Bitnami Vulnerability Database](https://github.com/bitnami/vulndb) - [CISA Known Exploited Vulnerability Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [CISA Vulnrichment](https://github.com/cisagov/vulnrichment) - [Chainguard Security Feed](https://packages.cgr.dev/chainguard/osv/all.json) - [Debian Security Bug Tracker](https://security-tracker.debian.org/tracker/) - [Exploit Prediction Scoring System (EPSS)](https://api.first.org/epss/) - [GitHub Advisory Database](https://github.com/advisories/) - [GitLab Advisory Database](https://gitlab.com/gitlab-org/advisories-community/) - [Golang VulnDB](https://github.com/golang/vulndb) - [National Vulnerability Database](https://nvd.nist.gov/) - [Oracle Linux Security](https://linux.oracle.com/security/)

Docker Scout aggregates vulnerability data from multiple sources, continuously updating to ensure security posture is represented using the latest available information in real-time. It uses various package repositories and security trackers, including AlmaLinux, Alpine, Amazon Linux, Bitnami, CISA, Chainguard, Debian, EPSS, GitHub, GitLab, Golang, NVD, and Oracle Linux.