./cra/sbom_watch
SBOM exploit watch
Drop the SBOM of a firmware release. Every component is checked against NVD and OSV for known vulnerabilities, and against CISA's and ENISA's lists of vulnerabilities exploited in the wild. Save it in your browser and it is rechecked every time you come back.
# parsed in your browser · only component names, versions and identifiers are sent, straight to NVD and OSV
man sbom_watch
How it works
Your SBOM stays with you
The file is read in your browser. Component names, versions and identifiers go straight to NVD and OSV, the same public databases you would query by hand. Nothing is uploaded to this site.
Two exploited lists, merged
CISA's Known Exploited Vulnerabilities catalogue and ENISA's EU Vulnerability Database are combined and refreshed every six hours. ENISA's list only reaches your browser through this site, because its API does not allow direct browser access.
Watching without an account
Save an SBOM and every visit re-matches it against the latest lists in seconds, telling you what became exploited since you last looked. Bookmark the page and open it each morning.
Only as good as the SBOM
Matching works on CPE and purl. Components without them cannot be looked up, and a wrong CPE gives wrong results. Generate the SBOM from your build so the identifiers come from the source.
Sources: NVD CVE API 2.0, OSV.dev, CISA Known Exploited Vulnerabilities catalogue, ENISA EUVD. Engineering guidance, not legal advice. This product uses data from the NVD API but is not endorsed or certified by the NVD.