vulnerability data-source coverage matrix

[aurangzaib048]

Buyers ask "do you support database X?" per-database (CVE, NVD, OSV, GHSA, EUVD, PyPA, RustSec, Go vulndb, Ruby, PHP, Debian/Ubuntu/Red Hat, KEV, Exploit-DB, ZDI, JVNDB, MSRC, ...). The honest answer is layered and currently written down nowhere.

Publish a coverage matrix documenting how each source reaches sbomify findings:

• aggregated by the OSV backend: GHSA, PyPA, RustSec, Go vulndb, Ruby Advisory DB, PHP/Packagist (FriendsOfPHP), Debian, Ubuntu, Alpine, Rocky and the other OSV ecosystems (https://google.github.io/osv.dev/faq/), including OSV MAL- malicious-package advisories
• mirrored by the Dependency-Track backend: NVD (CVSS/CWE/CPE enrichment), GitHub Advisories, OSV
• consumed directly: CISA KEV (and ENISA EUVD exploited list once shipped)
• present as identifiers/links when advisories carry them: EUVD, JVNDB, CERT/CC VU#, ZDI, Exploit-DB, MSRC, vendor advisories (RHSA/USN/DSA)
• prioritization signals: KEV now; EPSS and CVSS 4.0 tracked in vuln: capture EPSS and CVSS 4.0 from scanner payloads sbomify#1142

State the delegation strategy plainly: sbomify does not build a proprietary vulnerability database; it rides the aggregation layers the ecosystem standardized on, which is why new sources (e.g. EUVD in Dependency-Track, DependencyTrack/dependency-track#4863) arrive without sbomify-side work.

Acceptance:

• Matrix page live under docs/compliance, linked from the vulnerability feature docs
• Every database named above appears with its access path or an honest "not consumed" note