SCA
Know which library
will hurt you first.
Every dependency you ship, matched against OSV advisories and ranked by what attackers are exploiting right now, with the version that fixes it.
Advisories by exploitability
payments-service · 214 components
| Component | Advisory | Signal | Fix |
|---|---|---|---|
| log4j-core 2.14.1 | CVE-2021-44228 | Known exploited | 2.17.1 |
| jackson-databind 2.9.8 | CVE-2019-12384 | EPSS 0.71 | 2.9.9.1 |
| lodash 4.17.15 | CVE-2020-8203 | EPSS 0.03 | 4.17.19 |
| openssl 1.1.1k | CVE-2021-3711 | EPSS 0.12 | 1.1.1l |
| python 3.7 | End of life | No fixes | 3.12 |
CycloneDX 1.5 · SPDX 2.3 · OpenVEX · signedDownload
What it does
- Every major ecosystemJavaScript, Python, Go, Java, .NET, Rust, PHP and Ruby lockfiles and manifests.
- Container imagesPackages and layers in any image, private registries included.
- Exploitation firstCISA known exploited status and EPSS probability on every advisory.
- Fix versionsThe version that fixes each advisory, when one exists.
- VEX you can defendAffected, under investigation, fixed or not affected, each backed by evidence.
- Existing SBOMsBring a CycloneDX or SPDX document and analyse it as is.
What you get
- Ranked dependency findings with fixed versions
- An advisory register across every asset
- VEX statuses proven by rescans
- Findings in the shared tracker
Mapped to
- OSV
- CISA KEV
- EPSS
- OpenVEX
How it works
- Add a targetA repository, a lockfile, a container image or an SBOM.
- Read the rankingKnown exploited and fixable advisories rise to the top.
- Upgrade and rescanA rescan proves the fix and updates the VEX status.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
How does it decide what to fix first?
By severity, then exploitation: whether CISA lists the advisory as exploited, its EPSS probability, and whether a fixed version exists.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.