Operations · software supply chain

Your dependencies are an attack surface. This console shows you which ones matter.

Each repository includes hundreds of third-party components, beyond the protection of a firewall. CVETriage cross-references public sources — NVD, KEV, EPSS and OSV/GHSA — and traces vulnerable code to its call sites to help identify what is reachable in your application. Local analysis, with optional Mistral support.

Source code

Fig. 01 — Vulnerability intelligence feeds Continuous collection · local correlation

NVD · MITRE · CISA KEV · FIRST EPSS · OSV/GHSA → correlation on the local workstation

—

Locally indexed CVEs

—

Confirmed exploitation · KEV

—

Probability scores · EPSS

Fig. 02 — From noise to action Each stage removes irrelevant findings

Fig. 03 — Severity × reachability Click a cell to filter

Weakness families

Findings register Click a row for details

Risk	Package	CVE	CVSS	Severity	Reachability	KEV	OSV

Approach

Five stages, from noise to action

A conventional scanner can return hundreds of alerts without a clear next step. This pipeline filters out irrelevant findings at each stage to help you focus on what needs action.

Inventory

Syft inventories the components in your repository, including exact versions and transitive dependencies. Protection starts with knowing what is there.

Correlation

Each component is checked against the local database: NVD CVEs, known exploitation from CISA KEV, and 30-day exploitation probability from EPSS. Three sources, three perspectives.

Cross-check

OSV and GHSA provide an additional advisory check. Already-patched versions are removed, and disagreements between sources are flagged to help reduce false positives.

Reachability

AST analysis checks whether vulnerable functions are imported, called or reachable from an entry point. This adds execution context to severity scores.

Response

A combined risk score, a plain-language explanation and an exact upgrade command. Optional Mistral analysis explains the findings; fixed versions come from advisory data.

Control panel

Start a scan

One local path, six options. Source code stays on your machine. Package coordinates are sent out only when OSV cross-checking is enabled.

Target Local analysis

Repository path

Cross-check OSV/GHSA Removes already-patched versions and flags disagreements. Strongly recommended. LLM analysis (Mistral) Triage, explanations and upgrade commands. Requires MISTRAL_API_KEY. Reachability analysis AST analysis: is vulnerable code imported, called or exposed? OSV-only mode No local database required (CI mode). Narrower coverage. Full scan (node_modules) Slower; also scans vendored dependencies. Semantic matching (Qdrant) Experimental — requires the local vector index.

Scan history

No saved scans