Shadow CVE

Shadow CVE finds the vulnerabilities that never became a CVE. Maintainers often fix a security bug in a quiet PR, list it as a one-line item in a release note, or leave a credible report open in an issue. Scanners like npm audit, Dependabot and OSV only know what is in the advisory databases, so everyone who depends on the package can stay exposed without knowing it. Paste a public GitHub repo. Shadow CVE reads its releases, pull requests, issues and commits, and drops anything already covered by a published advisory. It flags candidate findings in four groups: - vulnerabilities silently fixed with no advisory; - fixes still waiting in an open PR; - credible reports that were never fixed; - published CVEs whose fix was never merged. Each finding cites the code or report it is based on, with CWE, severity, attacker input, impact and a confidence score, so a human can check it quickly. In testing on popular open-source packages, it surfaced SSRF filter bypasses that we then reproduced against the latest published release, and that standard scanners do not attribute to the package. An optional sandbox mode re-tests published advisories in a Google-hosted environment by running the exploit before the fix, after the fix and on today's code, read-only behind a policy hook.