Tools / Vulnerabilities

Dependency vulnerability scanner

Drop in a lockfile (npm, yarn, pnpm, pip, Poetry, uv, Go, Cargo, Ruby, Composer, Maven, NuGet) and see every package with a known vulnerability, what is being exploited, and the version that fixes it.

Browser + public API

Loading tool…

Good to know

Use the lockfile, not the manifest: package.json says ^4.17 while package-lock.json says exactly which 4.17.x is installed.
Fix “exploited” packages first, then critical and high. A vulnerable dev-only package matters less than one shipped to production, but still matters in CI.
Data comes from OSV.dev, which merges GitHub, PyPI, Go, RustSec and other advisory databases. Add a scanner such as osv-scanner or npm audit to CI so this runs on every change.

Related tools

Exploited vulnerabilities, last 365 days
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.CVE lookup
Everything about one CVE on one page: description, CVSS scores, exploitation in the wild (CISA KEV), EPSS probability, affected products and fixed package versions. Or search a product for its newest CVEs.CVSS 4.0 and 3.1 calculator
Score a vulnerability with CVSS 4.0 or 3.1, explained in plain words, or paste a vector to see what it means.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.