Triage actively exploited GitHub SBOM vulnerabilities with OSV and Jira
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 26 nodes and runs on a schedule (every 6 hours). Along the way it connects GitHub and Jira Software. It also calls cisa.gov, euvdservices.enisa.europa.eu and api.osv.dev over HTTP.
How it runs
Trigger: On a schedule (every 6 hours).
- Reporting Policy (Edit Fields (Set)): sets 5 fields: product_repos, ticket_label, early_warning_hours…
- Fetch CISA Exploited List (HTTP Request): calls cisa.gov
- Fetch EU Exploited List (HTTP Request): calls euvdservices.enisa.europa.eu
- Both Feeds Read (Merge): merges the data from its input branches
- Check Both Feeds Answered (Code): runs custom JavaScript code
- Feeds Complete? (If): checks a condition and branches into true / false
- Read The Product List (Code): runs custom JavaScript code
- Stop: A Feed Did Not Answer (Stop and Error): stops the run with an error
- Any Product Listed? (If): checks a condition and branches into true / false
- One Item Per Repo (Split Out): splits a list into separate items
…plus 15 more steps. See the full node list below.
Services it uses
HTTP calls to: cisa.gov, euvdservices.enisa.europa.eu, api.osv.dev
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (11)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - Edit Fields (Set)
n8n-nodes-base.set - HTTP Request
n8n-nodes-base.httpRequest - Merge
n8n-nodes-base.merge - Code
n8n-nodes-base.code - If
n8n-nodes-base.if - Stop and Error
n8n-nodes-base.stopAndError - Split Out
n8n-nodes-base.splitOut - GitHub
n8n-nodes-base.github - Jira Software
n8n-nodes-base.jira - Switch
n8n-nodes-base.switch
From the author
Quick overview Every six hours, this checks the software libraries your products use against public lists of security holes that hackers are actively using right now. For each real match it opens a Jira ticket with the EU Cyber Resilience Act reporting…