Check your stack in seconds.
Paste a package.json, an SBOM or a machine's package list: the known vulnerabilities of your versions are shown, exploited ones first.
What you can paste
- a manifest or a lockfile, such as a
package.json; - a SBOM CycloneDX or SPDX (your software bill of materials);
- a machine's package list:
dpkg -l,rpm -qa,apk info -v,winget list,Get-Packageorbrew list --versions; - a simple "name version" list, one component per line.
200 KB at most: for a large project, keep the manifest rather than the full lockfile.
What you get
- the number of known vulnerabilities affecting your versions, and how many are already exploited by attackers;
- for each component, the CVSS severity, the exploitation probability (EPSS) and the version to reach;
- the list of unrecognized components, so you can correct the input.
And then
The analysis holds for today. A free account takes over this list and alerts you as soon as a new vulnerability affects it; the agent and connectors then keep the inventory up to date. To understand the method, read CVE monitoring, from alert to patch.
Frequently asked questions
Is the tool really free?
Yes, with no account and no credit card. Creating an account is only useful to be alerted to the next vulnerability that affects these components.
Are my files kept?
No. The analysis is done on the fly; only the recognized components stay in your browser, to prefill your account if you create one.
Which sources are used?
TechWatchAlert's vulnerability database, fed by 19 sources, including the CVE list, the KEV catalog, EPSS, GitHub and OSV advisories, CERT-FR and the EUVD.
The next critical vulnerability drops tomorrow morning
Know before noon whether it affects you, and who is on it.
Free plan, no credit card · hosted in France