Dependency Security Glossary

A–D

Advisory

A published notice describing a security vulnerability in a specific software package, including affected versions and remediation steps.

CPE (Common Platform Enumeration)

A structured naming scheme for identifying software products. Used by NVD for matching vulnerabilities to affected software. OSV vs NVD comparison.

CVE (Common Vulnerabilities and Exposures)

A unique identifier (e.g., CVE-2024-1234) assigned to a publicly known security vulnerability. Maintained by MITRE. Understanding vulnerabilities.

CVSS (Common Vulnerability Scoring System)

A numerical score (0–10) measuring the theoretical severity of a vulnerability. Does not indicate exploitation likelihood. CVSS vs EPSS.

CWE (Common Weakness Enumeration)

A categorization system for software weaknesses (e.g., CWE-79 for XSS). Describes the type of flaw, not a specific instance.

Dependency Confusion

A supply chain attack where an attacker publishes a malicious package to a public registry using the same name as a private internal package. Dependency confusion attacks explained.

Dependency Graph

A tree structure showing all direct and transitive dependencies of a project, including version constraints.

Direct Dependency

A package explicitly declared in your project's manifest or lock file (e.g., listed in package.json).

E–L

EPSS (Exploit Prediction Scoring System)

A probability score (0–1) indicating the likelihood a vulnerability will be exploited in the wild within 30 days. Published by FIRST.org. What is EPSS.

Exploit

Code or technique that takes advantage of a vulnerability to achieve unauthorized access or behavior.

Exploit Prediction

See EPSS.

GHSA (GitHub Security Advisory)

GitHub's vulnerability database, which feeds into OSV. Uses the GHSA identifier format.

KEV

See CISA KEV.

CISA KEV (Known Exploited Vulnerabilities)

CISA's catalog of vulnerabilities confirmed to be actively exploited. US federal agencies must remediate KEV entries within mandated timelines. CISA KEV explained.

Lock File

A file (e.g., package-lock.json, poetry.lock, composer.lock) that pins exact dependency versions, including transitive dependencies. Essential for reproducible builds and accurate scanning.

M–R

Manifest

A project configuration file declaring dependencies (e.g., package.json, requirements.txt, go.mod). May specify version ranges rather than exact versions.

NVD (National Vulnerability Database)

NIST's comprehensive vulnerability database. Provides CVSS scores and CPE matching. OSV vs NVD.

OSV (Open Source Vulnerabilities)

Google's open-source vulnerability database aggregating ecosystem-native advisories. Uses package identifiers (PURL) instead of CPE. OSV vs NVD.

Patch

A code fix that addresses a vulnerability. Usually delivered via a version update.

Pre-release

A software version (e.g., 2.0.0-beta.1) not yet considered stable. Pre-release versions may contain unpatched vulnerabilities.

Provenance

Verifiable metadata about how a software artifact was built, including source repo, build system, and build parameters. Part of the SLSA framework.

Remediation

The process of fixing a vulnerability, typically by upgrading to a patched version, applying a workaround, or removing the affected dependency.

Reproducible Builds

A build process that produces identical outputs from identical inputs, allowing independent verification of build integrity.

Risk Score

A composite score combining vulnerability severity (CVSS), exploitation likelihood (EPSS), and exploitation status (KEV) to prioritize remediation.

S–Z

SBOM (Software Bill of Materials)

A machine-readable inventory of all components in a software product, including dependencies, versions, and suppliers. SBOM requirements 2026.

SCA (Software Composition Analysis)

A category of security tools that identify known vulnerabilities in third-party and open-source components. GeekWala is an SCA tool. What is dependency vulnerability scanning.

Semantic Versioning

A versioning scheme (MAJOR.MINOR.PATCH) where major changes break compatibility, minor changes add features, and patch changes fix bugs.

SLSA (Supply chain Levels for Software Artifacts)

A framework of security practices for protecting the software supply chain, from source code to build to distribution.

SSVC (Stakeholder-Specific Vulnerability Categorization)

A decision framework for prioritizing vulnerabilities based on exploitation status, automatable exploitation, and mission impact.

Supply Chain Attack

An attack that compromises software by targeting its dependencies, build tools, or distribution channels rather than the software itself. Supply chain attacks in 2026.

Transitive Dependency

A package that your project depends on indirectly, through another dependency. Often the source of hidden vulnerabilities.

Triage

The process of evaluating and prioritizing vulnerabilities based on exploitability, impact, and relevance to your specific environment. What to do when your scanner finds 200 CVEs.

Typosquatting

Publishing a malicious package with a name similar to a popular package (e.g., lod-ash instead of lodash) to trick developers into installing it.

VEX (Vulnerability Exploitability eXchange)

A document format for communicating whether a product is affected by a specific vulnerability and if so, what remediation is available. What is VEX.

Vulnerability Database

A curated collection of known security vulnerabilities with metadata including affected software, severity, and remediation. Examples: NVD, OSV, GHSA.

Yanked Package

A package version that has been withdrawn from a registry, typically due to a security issue or critical bug. Should not be installed but may remain in existing lock files.

Zero-day

A vulnerability that is exploited before the vendor is aware of it or has released a patch.