Vulnerability Feeds
Sysdig Vulnerability Management Data Sources and Feeds
Planned change for 22 June 2026. Sysdig is making improvements to Alpine and Ubuntu vulnerability feeds and adding Python PDM support. After this release, customers may see more Alpine findings (Sysdig will report vulnerabilities without an available fix) and severity changes on Ubuntu CVEs (CVSS v3 will replace Ubuntu priority). See the SaaS Sysdig Secure Release Notes for details.
Sysdig Secure continuously checks against a wide range of vulnerability databases. The current database list includes:
- NIST NVD
- VulnDB
- NPM
- Python
- Ruby
- Alpine Linux
- Centos
- Debian
- Red Hat
- Red Hat EUS
- Rocky ERRATA
- Ubuntu
- Amazon Linux
- Alibaba Linux
- Oracle Linux
- Chainguard
- Wolfi
- Amazon BottleRocket
- PHP Advisory
- Go Vulnerability Database
- GitHub Advisories
- GitLab Advisories
- First.org EPSS
- Alma Linux
- SUSE
- Azure Linux
- Gentoo GLSA
- PhotonOS
- Microsoft
Vulnerability Feed Synchronization Interval
Sysdig aims to sync vulnerability feeds at least once per day. In general, feeds are synchronized every 8 hours to maintain up-to-date vulnerability data.
Individual feeds may experience synchronization issues, prompting manual synchronizations. As a result, the precise timing for synchronization of specific feeds may vary slightly.
Supported Operating Systems
Non-OS-Based Sources and Supported Package Types
| Non‑OS‑Based Sources | Matched Package Types | Source | CVSS Score | Severity | Fix Date | Publish Date | Disclosure Date |
|---|---|---|---|---|---|---|---|
| NPM (JavaScript) | NPM (JavaScript) | NPM | NVD | NVD | VulnDB | NPM | NPM |
| Python (Pypi) | Python | Python Advisory > GitHub > GitLab | NVD | NVD | VulnDB | Python Advisory | Python Advisory |
| Ruby | Ruby Gems | GitHub > GitLab > Ruby Advisory | NVD | NVD | VulnDB | GitHub | GitHub |
| Rust | Cargo (Rust) | GitHub | NVD | NVD | VulnDB | GitHub | GitHub |
| Go | Golang (built with Go 1.13+) Go Runtime | GitHub > GitLab > Go Vulnerability Database | NVD | NVD | VulnDB | GitHub | GitHub |
| Java | Java JAR WAR EAR | GitHub > GitLab | NVD | NVD | VulnDB | GitHub | GitHub |
| PHP | Composer (PHP) | PHP Advisory > GitHub > GitLab | NVD | NVD | VulnDB | PHP Advisory | PHP Advisory |
| C# | NuGet (.Net) | GitHub | NVD | NVD | VulnDB | GitHub | GitHub |
Column Legend
| Column | Description |
|---|---|
| Source | The specific database or advisory where Sysdig matches vulnerabilities, whether it’s from a vendor, an operating system, or a non‑OS package. |
| Matched Package Types / Versions | The programming languages or operating system versions that are scanned for vulnerabilities, matched against specific sources. For packages, it indicates supported types, and for OS, the supported versions. |
| CVSS Score | The primary vulnerability score, such as NVD, displayed in the UX or reports. Additional scores from vendor-specific sources may also be available. |
| Severity | The primary severity level derived from the score, shown in the UX or reports. Vendor-specific severities may also be displayed where applicable. |
| Fix Date | For OS-based sources, this field indicates the scheduled remediation date determined by a hierarchy: Vendor Fix Date > NVD Fix Date > VulnDB Fix Date. For non‑OS‑based sources—where a dedicated fix date isn’t provided—this field is marked as N/A. |
| Publish Date | The date the vulnerability was published, sourced directly from the vendor’s security feed. |
| Disclosure Date | The date the vulnerability was publicly disclosed, also sourced directly from the vendor’s security feed. |
