RPM

Red Hat Package Manager format used by Red Hat-based Linux distributions

Package analysis

Cataloger + Evidence	License	Dependencies			Package Manager Claims
Cataloger + Evidence	License	Depth	Edges	Kinds	Files	Digests	Integrity Hash
rpm-archive-cataloger `*.rpm`
rpm-db-cataloger `var/lib/rpmmanifest/container-manifest-2`		Transitive		Runtime
rpm-db-cataloger `{var/lib,usr/share,usr/lib/sysimage}/rpm/{Packages,Packages.db,rpmdb.sqlite}`		Transitive	Complete	Runtime

Vulnerability scanning

Data Source	Disclosures		Fixes		Track by Source Package
Data Source	Affected	Date	Versions	Date	Track by Source Package
AlmaLinux OSV Database (ALSA)
Amazon Linux Security Center (ALAS)
Microsoft AzureLinux OVAL
Red Hat Security Data API (RHSA)
National Vulnerability Database (NVD)
Microsoft CBL-Mariner OVAL
Oracle Linux Security (ELSA)
SUSE Security OVAL (SUSE-SU)

Operating systems

Operating System	Supported Versions	Provider	Data Source
AlmaLinux	`8`, `9`, `10`	`alma`	AlmaLinux OSV Database
Amazon Linux	`2`, `2022`, `2023`	`amazon`	Amazon Linux Security Center
Azure Linux	`3.0`	`mariner`	Microsoft CBL-Mariner OVAL
CentOS	`5`, `6`, `7`, `8`	`rhel`	Red Hat Security Data API
Fedora	minimal support (CPE-based)	`nvd`	National Vulnerability Database (NVD)
CBL-Mariner	`1.0`, `2.0`	`mariner`	Microsoft CBL-Mariner OVAL
OpenSUSE Leap	minimal support (CPE-based)	`nvd`	National Vulnerability Database (NVD)
Oracle Linux	`5`, `6`, `7`, `8`, `9`, `10`	`oracle`	Oracle Linux Security
Photon OS	minimal support (CPE-based)	`nvd`	National Vulnerability Database (NVD)
Red Hat Enterprise Linux	`5`, `6`, `7`, `8`, `9`, `10` EUS: `5.9`, `6.4+`, `7`, `8.1`, `8.2`, `8.4`, `8.6`, `8.8`, `9`	`rhel`	Red Hat Security Data API
Rocky Linux	`5`, `6`, `7`, `8`, `9`, `10`	`rhel`	Red Hat Security Data API
SUSE Linux Enterprise Server	`11`, `12`, `15`	`sles`	SUSE Security OVAL

Next steps

Last modified November 26, 2025: allow local too invocation (d20d613)