# Source: https://docs.snyk.io/scan-with-snyk/snyk-open-source/manage-vulnerabilities/snyk-vulnerability-database.md

# Snyk Vulnerability Database

The [Snyk Vulnerability Database](https://security.snyk.io) contains a comprehensive list of known security vulnerabilities. This provides the key security information used by Snyk products to find and fix code vulnerabilities.

You can inspect the database at <https://security.snyk.io/>, or you can incorporate database information into your own systems.

{% hint style="info" %}
This database is separate from standards bodies’ databases, as Snyk is recognized as an official authority on security.
{% endhint %}

## About the Vulnerability Database

### Snyk security team

The Snyk security team is a group of experts dedicated to finding new vulnerabilities. The team has contributed multiple discoveries to authorities such as CVE.

{% embed url="<https://youtu.be/CvtVDyYpXO4>" %}
Snyk Vulnerability Database
{% endembed %}

The Snyk security team maintains the database to ensure that database remains consistently highly accurate, and eliminates false positives.

* All items in the database are analyzed and verified.
* The team also invests in proprietary research to discover new vulnerabilities. You can consult the [disclosed vulnerability list](https://security.snyk.io/disclosed-vulnerabilities) to see all discovered vulnerabilities, by both first-party and third-party research.

### Interval notation and semantic versioning

The Snyk Vulnerability Database uses interval notation to express [semantic versioning](https://semver.org/) across the many supported ecosystems.

You can check the interval notation for all vulnerabilities listed in the Snyk Vulnerabilities Database. Several different interval notations are supported by the Snyk Vulnerability Database:

* Open interval notation - This does not include any limit points and uses `()` parenthesis for the notation.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-25120f0b54b52e8c5671a17cd3f0b9a6a51d11c6%2Fopen%20interval.png?alt=media" alt=""><figcaption><p>Open interval notation</p></figcaption></figure>

* Closed interval notation - This includes all its limit points and uses `[]` parenthesis for the notation.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-3cf5da34431a6e3ab4de55e921baa8e5625c0965%2Fclosed%20interval.png?alt=media" alt=""><figcaption><p>Closed interval notation</p></figcaption></figure>

* Half-closed interval notation - This includes only one of the limit points and uses `[)` or `(]` parenthesis for the notation. This example includes an infinite closed interval presented like this `[,3.7.2)`, meaning that it affects all versions up to `3.7.2`.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-faa9e38c2269015c904911a734e05f93c140108f%2Fhalf-closed.png?alt=media" alt=""><figcaption><p>Half-closed interval notation</p></figcaption></figure>

### Vulnerability sources

Most of the vulnerabilities in the Snyk database originate from one of these sources:

1. Monitoring other vulnerability databases, such as CVEs from [NVD](https://nvd.nist.gov) and many others.
2. Monitoring user activity on GitHub, including issues, PRs, and commit messages that may indicate a vulnerability.
3. Bulk research, using tools that look for repeated security mistakes across open-source package code.
4. Manual research, done by the Snyk Security team to manually audit more widely used packages for security flaws.

For every issue deemed to be a real vulnerability, Snyk assigns the correct CVSS (severity) score and package version specification, creates an advisory, and makes this issue available to Snyk products for your use.

## <sup>Package Health Score</sup>

Snyk package health score helps you understand the overall health and reliability of open source packages. It provides a rating between 0 and 100, with higher scores indicating healthier and more trustworthy packages.

The following table lists supported languages and the availability of package health insights for each, based on their associated ecosystems.

| Language   | Package health data availability |
| ---------- | -------------------------------- |
| Go         | ✔️                               |
| JavaScript | ✔️                               |
| TypeScript | ✔️                               |
| Python     | ✔️                               |

{% hint style="info" %}
Package health data is available in [Snyk Advisor](https://snyk.io/advisor/) and on [security.snyk.io](https://security.snyk.io/) package pages. CLI, IDE, and CI/CD integrations do not yet display package health information.
{% endhint %}

The package health score is calculated based on four main categories: Popularity, Maintenance, Security, and Community.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-85d6f0b19348743ea235f9dd86a61776c47d831f%2Funknown.png?alt=media" alt="" width="365"><figcaption><p align="center"><br>Overview of package health score</p></figcaption></figure>

Each category contributes to the overall score, enabling developers to evaluate various aspects of an open-source package.

#### Popularity

This category helps you understand the prevalence of an open-source package by using metrics such as downloads and the number of stars in its source code repository to measure its popularity.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-2a0876a3a8888324c3c299f355ec80a1484a61a7%2Funknown.png?alt=media" alt="" width="563"><figcaption><p>Popularity category</p></figcaption></figure>

#### Maintenance

This category helps you gain insights into the health of an open-source dependency and assess a Project's sustainability.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-043a67ac3716e8d691e9f62d992e347ada5c359b%2Funknown.png?alt=media" alt="" width="375"><figcaption><p>Maintenance category</p></figcaption></figure>

#### Security

This category helps you quickly assess the security posture of an Open Source Project and its past versions. By connecting your Project with Snyk enables you to receive fixed and automations that enable security at scale and speed.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-15c9fdac2688db40b34612bb4db7d7203b69bd43%2Funknown.png?alt=media" alt=""><figcaption><p>Security category</p></figcaption></figure>

#### Community

This category helps you understand whether the community is thriving around an open-source package that you use in your Project or if it has gone stale. You can also gauge the status with project metrics.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-0ae1e3643529558e7a9eccdbf9f6268fd06f1c0d%2Funknown.png?alt=media" alt=""><figcaption><p>Community category</p></figcaption></figure>

## Incorporating the Vulnerability Database into your systems

Incorporating information into your own systems is useful for customers who already have their own security products. You can benefit from Snyk’s expertise and accumulated knowledge with access to this database. This gives your development teams access to trusted intelligence, allowing them to rapidly secure open source and container code.

The Snyk Vulnerability Database includes two feeds:

* Application Feed: with manually-curated content and summaries, including code snippets where applicable.
* Operation System Feed: Linux vulnerabilities from all supported Linux distributions.

These feeds are licensed separately as standalone products.