Check an SBOM for free
Upload the bill of materials of your software and see within a minute which known vulnerabilities it contains. No sign-up, no cost.
No SBOM at hand?
This was a snapshot. A new vulnerability may appear tomorrow.
Secupipe keeps checking your SBOMs, alerts you about new vulnerabilities and prepares the reports required by the CRA. One project is free forever.
Start for free See pricingWhat happens to your file
The file is processed for this one check only and is not stored. For matching, only package identifiers (name and version of the components) are sent to the public vulnerability database OSV. More on Security & privacy.
What the check shows
- Known vulnerabilities per component, matched against OSV.
- Actively exploited vulnerabilities according to the CISA KEV catalog. Under the CRA these must be reported within 24 hours.
- Exploit probability (EPSS) and the version that fixes the vulnerability.
No SBOM yet?
You can create an SBOM with free tools in a minute, for example in your project folder:
syft dir:. -o cyclonedx-json > sbom.json
or
trivy fs --format cyclonedx -o sbom.json .
Prefer to hand it off? With the starter package we connect your pipelines for you.