Loading
Tool · Free, no signup
Drop in a lockfile or SBOM. Get matched CVEs with KEV and EPSS context in seconds. Files are parsed entirely in your browser.
Files are parsed locally. We only send package names + versions to our matching API — never the file itself, never source code, never secrets.
Lockfiles, manifests, and standardised SBOMs across npm, PyPI, Maven, Go, RubyGems, and Cargo. Mixed-ecosystem SBOMs work too.
Every match is enriched with CISA Known Exploited Vulnerabilities status and FIRST EPSS exploit-probability scores so you can prioritise fast.
Export bulk Jira or ServiceNow ticket text with one click. CSV and PDF reports for stakeholders are one click further.
Your file stays on your device. It's parsed in your browser — only package names and versions are sent to our API to look up CVEs. File paths, author info, registry URLs and checksums never leave your device.
We don't log, store or share your manifest server-side. Scan results are cached only in your own browser (localStorage) so you can come back to them — use Clear scan to delete that copy.
Drop a manifest here
package.json, package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, pom.xml, go.mod, Gemfile.lock, Cargo.lock, CycloneDX, SPDX
If you already have CVE identifiers from another tool, the bulk analysis view sorts them by KEV, EPSS, and CVSS in one pass.
Open bulk analysis