Google's OSV-Scanner and GeekWala read from the same place: the OSV.dev vulnerability database. Run both against the same lockfile and you'll get largely the same list of CVEs — that's expected, not a coincidence, since GeekWala's own OSV database explainer treats OSV.dev as a primary source. So this isn't a "which tool finds more bugs" comparison. It's a comparison of what happens after the CVE list exists — a terminal table you have to interpret yourself, or a triaged, historical, exploitation-aware view.
TL;DR: OSV-Scanner is a free, open-source CLI from Google that queries OSV.dev and prints CVSS-scored findings — local, scriptable, and CI-friendly. GeekWala scans the same OSV data but adds an EPSS exploitation-probability score and a CISA KEV flag to every finding, plus a hosted dashboard, persistent scan history, and scheduled scans. Want a free, local, scriptable scanner? Use OSV-Scanner. Want to know which of those findings attackers are actually using, without building that pipeline yourself? That's the layer GeekWala adds. Plenty of teams run both.
Already comparing pricing and features to make a buying decision? See our full GeekWala vs OSV-Scanner comparison for the complete feature matrix and pricing breakdown. This article instead digs into how each tool's data sources, scan triggers, and exploit-prioritization signals actually work under the hood.
In This Article
- What OSV-Scanner does well
- What a CLI table can't tell you
- Feature comparison table
- Same CVE, two different experiences
- Using both together
- FAQ
What OSV-Scanner does well
OSV-Scanner earns its place in a lot of CI pipelines, and for good reason:
- Free and open source. Apache-2.0, maintained by Google's Open Source Security team, no seats, no usage caps, embeddable as a Go library.
- Local and offline. Nothing leaves your machine. It supports scanning against a locally downloaded copy of the OSV database for air-gapped or network-restricted environments.
- Official OSV.dev frontend. It's the reference implementation for querying OSV — if you trust the OSV data model, you can trust that OSV-Scanner reads it correctly.
- Broad lockfile support. npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, and more, all through one binary.
- Multiple output formats. Table, JSON, SARIF, markdown, and an HTML report — enough to wire into most CI systems without custom glue.
- A single static binary. No runtime dependencies to install, no account to create, no server to run.
If your whole workflow is "scan on every PR, fail the build on new findings," OSV-Scanner does that job without asking anything of you beyond a go install or a downloaded binary.
What a CLI table can't tell you
Run OSV-Scanner against a real project and you'll typically get back dozens of findings, each with a CVSS score and not much else to prioritize by. CVSS answers "how bad could this be in theory." It says nothing about whether the vulnerability is being exploited, has a public proof-of-concept, or has ever been seen in the wild. A 9.8 in a code path nobody calls sits at the same visual weight as a 9.8 that's actively being exploited right now — because OSV-Scanner's output doesn't distinguish them.
That's the gap EPSS and CISA KEV close. EPSS is a model that scores the probability a CVE will be exploited in the next 30 days. CISA KEV is a curated list of CVEs with confirmed, real-world exploitation. Neither appears in OSV-Scanner's default output — you'd need to export the JSON and join it against the EPSS feed and the KEV catalog yourself, on a schedule, to keep it current. GeekWala runs that enrichment on every scan and shows the score and the flag directly next to each finding, so triage starts from "what's actually risky" instead of "what's theoretically severe."
The other gap is state. OSV-Scanner is stateless by design — each run prints a report and forgets it existed. There's no answer to "did we get worse this month," no scheduled re-scan, and no dashboard a non-CLI teammate can open. That's a deliberate tradeoff for a CI tool, not a flaw, but it means the history and the "as of right now" cross-project view have to be built somewhere else.
Feature comparison table
| Dimension | OSV-Scanner | GeekWala |
|---|---|---|
| Vulnerability data source | OSV.dev | OSV.dev, enriched with EPSS + CISA KEV |
| EPSS exploitation score | Not shown by default | On every finding |
| CISA KEV flagging | Not shown | On every finding |
| Severity signal | CVSS only | CVSS + EPSS + KEV |
| Interface | CLI (table / JSON / SARIF / HTML) | Hosted web dashboard + API |
| Offline / air-gapped scanning | Yes | No — hosted service |
| Persistent scan history | No (stateless per run) | Yes |
| Scheduled re-scans | No (you wire up cron) | Yes (Pro) |
| Cross-project dashboard | No — one run, one report | Yes — all projects in one view |
| Ecosystem coverage | Broad (Go, npm, PyPI, Maven, and more) | 8 ecosystems (npm, PyPI, Maven, Packagist, Go, crates.io, RubyGems, NuGet) |
| Cost | Free, open source | Free tier + Pro |
Same CVE, two different experiences
Say a scan turns up a CVSS 7.5 CVE in a transitive dependency. In OSV-Scanner's output, that finding sits in a table alongside every other CVSS 7+ result — visually indistinguishable from a dozen others until you go read each advisory yourself. If that same CVE happens to be EPSS-high and CISA KEV-listed, OSV-Scanner's table won't tell you: you'd have to already know to check.
In GeekWala, that same finding carries its EPSS percentile and a KEV badge inline, so it's visibly the thing to patch this week — not because GeekWala found a different vulnerability, but because it's showing you a signal OSV-Scanner's output doesn't carry. Both tools agree on the finding. Only one of them tells you it's urgent without extra work on your part.
Using both together
These aren't really competitors — they sit at different layers of the same pipeline. A common pattern: run OSV-Scanner in CI to fail builds on new findings and to cover offline or air-gapped scans where nothing can leave the network, and use GeekWala for the weekly (or scheduled) triage pass across every project, where EPSS and KEV separate "patch this now" from "patch this eventually." That combination costs nothing beyond a Pro plan and gets you both CI-native gating and exploitation-aware prioritization.
If you're choosing just one: pick OSV-Scanner when you need a free, local, air-gapped, CI-native scanner and are comfortable doing your own EPSS/KEV enrichment. Pick GeekWala when you'd rather have that enrichment, plus history and a dashboard, without building the pipeline yourself. For a broader look at how other CLI-first scanners compare on the same axis, see our dependency scanner comparison and our roundup of free scanning tools.
Neither choice is permanent, and neither is exclusive. Teams commonly start with OSV-Scanner alone, add GeekWala once the CVSS-only backlog gets hard to triage by hand, and keep OSV-Scanner running in CI the whole time. If you're evaluating more than these two tools, our full scanner comparison hub covers how GeekWala stacks up against Snyk, Dependabot, npm audit, and Trivy on the same EPSS/KEV/dashboard axes used here — useful if OSV-Scanner isn't the only alternative on your shortlist.
FAQ
Does GeekWala use the same vulnerability data as OSV-Scanner?
Yes, for the ecosystems both tools cover, GeekWala scans OSV.dev — the same database OSV-Scanner queries. GeekWala's core data source is OSV, not a competing proprietary feed, which is why the two tools generally agree on which CVEs a given lockfile has.
Can OSV-Scanner show EPSS or CISA KEV scores?
Not out of the box. OSV-Scanner's documented output includes an OSV ID, CVSS score, ecosystem, package, and affected/fixed versions — no EPSS or KEV field. You can get there by exporting OSV-Scanner's JSON output and joining it against FIRST's public EPSS feed and CISA's KEV catalog yourself, on your own refresh schedule.
Is OSV-Scanner good enough on its own?
For CI gating and air-gapped scanning, yes — it's a solid, free, actively maintained tool built by Google's Open Source Security team. Where it runs out of runway is prioritization and history: once a scan produces 30+ CVSS-scored findings, deciding what to patch first, and tracking whether that number is trending up or down over time, is work OSV-Scanner deliberately leaves to you.
Do I have to choose between them?
No. OSV-Scanner in CI plus GeekWala for scheduled, cross-project triage is a common, low-cost combination — you get offline CI gating from one and exploitation-aware prioritization plus a dashboard from the other.
Scan your dependencies → — paste a lockfile from any of 8 ecosystems and see EPSS scores and CISA KEV flags on every finding. No install, no account required.
