Vulnerability intelligence your tools can defend.
Give scanners, enrichment pipelines, and coding agents structured advisory facts with traceable sources, not scraped guesses.
An openly licensed corpus of affected packages, version ranges, weaknesses, fixes, vulnerable symbols, and public-exploit signals—where public evidence supports them.
From raw CVEs to a defensible decision pipeline.
The corpus is designed for scanners, enrichment systems, and coding-agent workflows. Point one at the whole record set, narrow the scan to what matters now, or track only what changed since your last pull.
| What you want to do | What you consume |
|---|---|
| Feed a scanner or enrichment service | manifest.json + records |
| Focus a scan on the advisories that matter now | policies/ |
| Keep a recurring integration current | feed.json |
A policy narrows scanning scope without changing the scanner contract—your tool reads the same shape, just fewer records. The delta feed keeps a continuously updated integration current without re-reading the whole corpus each run.
Selection is scope, never a verdict. Choosing a smaller input set does not make everything outside it safe.
From advisory to executable evidence.
When public sources name vulnerable symbols, Ferralon preserves them. When a CVE arrives without that code-level detail, Ferralon analyzes public source and package changes to build the evidence downstream systems need.
The result is open vulnerability intelligence: vulnerable symbols, fixes, and code-level context that scanners, enrichment pipelines, and coding agents can use to find potentially vulnerable paths—not merely flag a package.
Every record has a receipt.
The manifest maps each advisory to its path and SHA-256 digest, so your tooling verifies the record bytes before it decodes them—a contract to consume, not an unexamined feed.
identifier · path · output_digest
Priority signals like EPSS and KEV stay separate from the scanner records, so a score describing a vulnerability in the world can never quietly become a claim about your code.
The corpus is CC BY 4.0—use it, study it, and build on it with attribution. The repository carries the field contract, the consumption protocol, and the upstream provenance and license terms behind every published record.