Security patches play a crucial role in the battle

against Open Source Software (OSS) vulnerabilities. Meanwhile,

to facilitate the development of OSS projects, both upstream and

downstream developers often maintain multiple branches. Due

to the different code contexts among branches, multiple security

patch variants exist for the same vulnerability. Hence, to ease the

management of OSS vulnerabilities, locating all patch variants

of an OSS vulnerability is pretty important. However, existing