Vulnerability Feeds
Sysdig Vulnerability Management Data Sources and Feeds
Since October 05, 2026, Sysdig takes the severity and CVSS score for non-OS package vulnerabilities from GitHub Advisories, and uses NVD only when GitHub has no score. You can see severity changes on existing findings, new findings, and changed policy results. OS packages do not change. See the SaaS Sysdig Secure Release Notes for details.
Sysdig Secure continuously checks against a wide range of vulnerability databases. The current database list includes:
- Alibaba Linux
- Alma Linux
- Alpine Linux
- Amazon BottleRocket
- Amazon Linux
- Azure Linux
- Centos
- Chainguard
- Debian
- First.org EPSS
- Gentoo GLSA
- GitHub Advisories
- GitLab Advisories
- Go Vulnerability Database
- Google COS
- Microsoft
- NIST NVD
- Oracle Linux
- NPM
- PhotonOS
- PHP Advisory
- Python
- Ruby
- Red Hat
- Red Hat EUS
- Rocky ERRATA
- SUSE
- Ubuntu
- VulnDB
- Wolfi
Vulnerability Feed Synchronization Interval
Sysdig aims to sync vulnerability feeds at least once per day. In general, feeds are synchronized every 8 hours to maintain up-to-date vulnerability data.
Individual feeds may experience synchronization issues, prompting manual synchronizations. As a result, the precise timing for synchronization of specific feeds may vary slightly.
Supported Operating Systems
Red Hat Hummingbird images need Sysdig CLI Scanner v1.30.0 or later, or Cluster Shield v1.26.0 or later.
Non-OS-Based Sources and Supported Package Types
Column Legend
| Column | Description |
|---|---|
| Source | The specific database or advisory where Sysdig matches vulnerabilities, whether it’s from a vendor, an operating system, or a non‑OS package. |
| Matched Package Types / Versions | The programming languages or operating system versions that are scanned for vulnerabilities, matched against specific sources. For packages, it indicates supported types, and for OS, the supported versions. |
| CVSS Score | The primary vulnerability score, displayed in the UX or reports. For non‑OS packages, Sysdig uses the GitHub Advisories score and falls back to NVD when GitHub has no score. Additional scores from vendor-specific sources may also be available. |
| Severity | The primary severity level derived from the score, shown in the UX or reports. Vendor-specific severities may also be displayed where applicable. |
| Fix Date | For OS-based sources, this field indicates the scheduled remediation date determined by a hierarchy: Vendor Fix Date > NVD Fix Date > VulnDB Fix Date. For non‑OS‑based sources—where a dedicated fix date isn’t provided—this field is marked as N/A. |
| Publish Date | The date the vulnerability was published, sourced directly from the vendor’s security feed. |
| Disclosure Date | The date the vulnerability was publicly disclosed, also sourced directly from the vendor’s security feed. |
