advisory-database

Oh good question. I can't answer this one as authoritatively as I'd like - I'll double check with the team next week. One thing to note is that the full CVSS 3.1 string is included in the database as assessed by NIST. The severity displayed by GitHub is stored as a "database specific" field, so it looks like we're trying to be explicit about the existence of multiple perspectives on severity (one of which is our own), but that we could do more to make that clear. https://github.com/github/advisory-database/blob/main/adviso...

We already have fixed versions (where they exist) - example link below. On backfilling the data to include advisories from before 2017 - absolutely. So far we've done this in a relatively ad-hoc way - you should already find that the most important (severe and wide-reaching) CVEs from before 2017 are in the database (and if there are any that aren't you think should be we'd love you to open an issue on the DB). We want to do a more complete backfill in the near future. https://github.com/github/advisory-database/blob/main/adviso...