Live advisory data · OSV.dev · CVSS v3.1

Package Vulnerability Scanner

Is your dependency tree safe to ship?

To check your dependencies for known vulnerabilities, paste any lockfile or manifest below and click Scan — every name@version pair is matched against the live OSV.dev database (CVE, GHSA, PYSEC, RUSTSEC, GO advisories), graded on the CVSS v3.1 scale, and returned as a triage board with the exact fixed version for each finding. Parsing happens entirely in your browser: only package names and versions are queried, your code never leaves your machine. Ten file formats across npm, PyPI, Maven, Go, crates.io, RubyGems, Packagist and NuGet are auto-detected.

Severity bands per FIRST.org CVSS v3.1 · advisory data: OSV.dev (Google Open Source Security) · aligned with OWASP A06:2021

8 ecosystems

10 file formats, auto-detected

Live OSV.dev

CVE · GHSA · PYSEC · RUSTSEC

Zero upload

Files parsed 100% in-browser

CVSS v3.1

Full base-score engine built in

legitlads-sca·awaiting manifest…

Upload file

Manifest or lockfile contents

Names + versions are sent to api.osv.dev — nothing else.

What one unpatched CVE actually costs

1 critical CVE left in production is how Equifax lost 147 M records in 2017 — a known, patched Apache Struts flaw (CVE-2017-5638) left unfixed for two months.

An average npm install pulls ~700 transitive packages. You directly chose perhaps 20 of them — the other 680 are trust by proxy.

Mean time from CVE publication to first exploit attempt is now under 48 hours for network-reachable flaws; Log4Shell scanning began within hours of disclosure.

The average cost of a data breach reached $4.88 M in IBM's 2024 report — versus roughly 15 minutes to bump a version number and re-run CI.

Check a single package version

Answers "is lodash 4.17.15 vulnerable?" in one click — exact version, live OSV.dev lookup, severity verdict and fixed release.

Package name

Exact version

Ecosystem

CVSS v3.1 score → severity rating

The exact FIRST.org bands this scanner applies, with real advisories at each level and the response SLA most security teams use.

CVSS score	Severity	Real-world example	Response SLA
0.0	None	Informational findings only	No action
0.1 – 3.9	Low	CVE-2020-7598 (minimist prototype pollution, 5.6 → low in some configs)	Next routine upgrade
4.0 – 6.9	Medium	CVE-2020-8203 (lodash prototype pollution, 7.4 originally triaged medium by many teams)	Within the sprint
7.0 – 8.9	High	CVE-2021-23337 (lodash command injection via template, 7.2)	Before next release
9.0 – 10.0	Critical	CVE-2021-44228 (Log4Shell, 10.0) · CVE-2017-5638 (Struts, 10.0)	24–48 h, deploy blocker
7.5	High	Typical unauthenticated DoS (AV:N/AC:L/PR:N/UI:N + A:H)	Before next release
8.1	High	Network attack, no privileges, high C+I impact (AC:H)	Before next release
8.8	High	CVE-2021-3807 (ansi-regex ReDoS rated 7.5; 8.8 = network RCE w/ user interaction)	Before next release
9.1	Critical	Unauthenticated network flaw with high C+I impact	24–48 h
9.8	Critical	CVE-2021-44228 class — network, no auth, no interaction, full C/I/A	Immediately
10.0	Critical	9.8 + scope change (escapes the vulnerable component)	Immediately

Need the dependency graph itself? → Browse all code-analysis tools

The math behind the grades

CVSS v3.1 base score (FIRST.org)

ISS = 1 − (1−C)(1−I)(1−A)
Impact = 6.42 × ISS  (scope unchanged)
Exploitability = 8.22 × AV × AC × PR × UI
Base = ⌈min(Impact + Exploitability, 10)⌉₀.₁

Worked (Log4Shell, CVE-2021-44228 — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): ISS = 1 − (0.44)³ = 0.915; changed-scope Impact = 7.52(0.915−0.029) − 3.25(0.895)¹⁵ ≈ 6.05; Exploitability = 8.22 × 0.85 × 0.77 × 0.85 × 0.85 ≈ 3.89; Base = min(1.08 × 9.94, 10) = 10.0 — Critical.

This page's exposure score

Exposure = min(100, 25·crit + 10·high + 3·med + 1·low)

Worked: 1 critical + 2 high + 3 medium = 25 + 20 + 9 = 54/100 — critical exposure, deploy blocker. Thresholds: 0 ship-ready · ≤9 low · ≤24 moderate · ≤49 high · 50+ critical. The weights mirror the asymmetry of real risk: one critical outweighs eight mediums because exploitation is near-certain once public.

Supported ecosystems & advisory sources

Ecosystem	Files auto-detected	Advisory feeds (via OSV.dev)
npm	package.json · package-lock.json · yarn.lock	GHSA, CVE via OSV
PyPI	requirements.txt	PYSEC, GHSA, CVE
Maven	pom.xml	GHSA, CVE
Go	go.mod	GO (vuln.go.dev), CVE
crates.io	Cargo.lock	RUSTSEC, CVE
RubyGems	Gemfile.lock	GHSA, CVE
Packagist	composer.lock	GHSA, CVE
NuGet	.csproj · packages.config	GHSA, CVE

Your recent scans

No scans yet this browser. Results are stored locally only — nothing syncs to a server.

How to scan your dependencies in 5 steps

1
Paste or drop your manifest
Paste the contents of package-lock.json, yarn.lock, requirements.txt, go.mod, Cargo.lock, Gemfile.lock, composer.lock, pom.xml or a .csproj into the console — or drop the file onto it. The format and ecosystem are auto-detected and parsed entirely in your browser.
2
Choose your depth
Quick Scan needs nothing else. Professional mode adds a devDependencies toggle and the single-package checker. Auditor mode exposes CVSS vectors, advisory aliases and report export.
3
Run the scan
Click Scan dependencies. Each name@version pair is checked against the live OSV.dev advisory database (CVE, GHSA, PYSEC, RUSTSEC, GO) — only package names and versions leave your machine, never your code.
4
Read the risk gauge and triage board
The gauge converts your findings into a 0–100 exposure score with a deploy/no-deploy verdict. The triage board lists every vulnerable package sorted by CVSS severity, with advisory links.
5
Apply the fix plan and re-scan
Each finding shows the exact fixed version to upgrade to. Bump those versions, regenerate your lockfile, paste it back in and re-scan until the gauge reads ship-ready.

Why dependency scanning became non-negotiable

In 2026, a platform engineer preparing a Friday release needs one answer before merging: does anything in this lockfile carry a known, exploitable CVE? Answering it used to mean installing a CLI, authenticating to a SaaS scanner, or waiting for a weekly security report. This tool exists to collapse that to a paste and a click — the same OSV.dev data the heavyweight scanners query, graded on the same CVSS v3.1 scale FIRST.org publishes, with no install and no code upload. The decision it serves is not "list my CVEs"; it is ship or block.

The modern threat is structural. When npm shipped in 2010, a typical application carried a few dozen libraries; today the average production install resolves around 700 transitive packages, and ecosystems like PyPI, Maven Central, crates.io and RubyGems follow the same curve. Every one of those packages is code you run with full privileges but did not write or review. The discipline that grew around this fact — software composition analysis (SCA) — is now codified in OWASP's Top 10 as A06:2021 "Vulnerable and Outdated Components" and required by frameworks from PCI DSS 4.0 to NIST's Secure Software Development Framework (SP 800-218).

The historical record reads like an escalating argument for scanning. 2016: the 11-line left-pad unpublish broke builds worldwide and exposed how deep transitive trust runs. 2017: Equifax lost 147 million records to CVE-2017-5638, an Apache Struts flaw that had a patch available for two months. 2018: the event-stream incident proved maintainer handoffs can smuggle malicious code into millions of installs. December 2021: Log4Shell (CVE-2021-44228, CVSS 10.0) turned "which of our services ship Log4j?" into a board-level question most organizations could not answer. 2024: the xz-utils backdoor (CVE-2024-3094) came within weeks of compromising the SSH stack of every major Linux distribution.

Governments responded in kind. US Executive Order 14028 (May 2021) made software bills of materials — SBOMs — a procurement requirement, and the EU Cyber Resilience Act extends the same logic to products sold in Europe. The data layer consolidated too: Google's OSV (Open Source Vulnerabilities) project unified GitHub Security Advisories (GHSA), PYSEC, RUSTSEC and the Go vulnerability database into one machine-readable schema with precise affected-version ranges, cross-referenced to MITRE's CVE list and NIST's NVD scoring. That consolidation is what makes a browser-based scanner like this one possible — and accurate.

Knowing where to scan matters as much as scanning. A manifest like package.json declares ranges (^4.17.0); only the lockfile records what actually installs, including every transitive package — which is where roughly four out of five real findings live. The comparison below is the one-table version of this page's most repeated advice:

Input	Versions	Transitive deps	Scan fidelity
package.json / pom.xml	Ranges (^ ~ >=)	Invisible	Approximate — minimum of each range
package-lock / yarn.lock / Cargo.lock…	Exact, resolved	Fully listed	Exact — recommended
SBOM (CycloneDX / SPDX)	Exact + provenance	Fully listed	Exact — audit-grade (EO 14028)

Severity, finally, is a triage signal, not a verdict. CVSS v3.1 measures worst-case technical impact; it does not know whether the vulnerable function is reachable in your code, whether the service is internet-facing, or whether an exploit is public (that last signal lives in CISA's Known Exploited Vulnerabilities catalog, which any 9.x finding should be checked against). The professional pattern this page encodes: lockfile in, CVSS-sorted board out, criticals blocked, highs fixed before release, mediums batched — and the scan repeated on every pull request, because advisories publish against code you already shipped. If you also need to diff two lockfiles after an upgrade, the sibling diff checker does exactly that, and the regex tester is where most of our users build their log-scrubbing patterns after an incident.

Vulnerability Scanning FAQs

How do I check if my npm packages have known vulnerabilities without installing anything?

Is a CVSS score of 7.5 high or critical?

What is the difference between a CVE and a GHSA advisory?

A CVE (Common Vulnerabilities and Exposures) is the vendor-neutral identifier issued through MITRE and enriched by NIST's NVD. A GHSA (GitHub Security Advisory) is GitHub's ecosystem-specific record, which usually maps package names and exact affected version ranges more precisely for npm, PyPI, Maven, and others. Most real vulnerabilities carry both IDs as aliases — OSV.dev merges them into one record, which is what this scanner reads.

Does this tool upload my source code anywhere?

What is OSV.dev and how trustworthy is its data?

OSV (Open Source Vulnerabilities) is Google's open, machine-readable vulnerability database. It aggregates and de-duplicates GitHub Security Advisories, PYSEC, RUSTSEC, the Go vulnerability database, and CVE records into one schema with precise affected-version ranges. It powers osv-scanner and is the backend several commercial SCA tools query. It is generally regarded as the most accurate open severity-and-range source available.

Should I block a production deploy over one high-severity CVE?

Decide by reachability and exploit status, not score alone. Block the deploy if the flaw is network-reachable in your usage, has a public exploit or sits in CISA's Known Exploited Vulnerabilities catalog, or affects auth, crypto or deserialization paths. Ship with a documented exception if the vulnerable function is provably never called and a fix is scheduled. This scanner's verdict line gives you the default call; your threat model finishes it.

How do I fix a vulnerable transitive dependency that I never installed directly?

Which file should I scan — package.json or package-lock.json?

Always prefer the lockfile. package.json holds version ranges like ^4.17.0, so the version actually installed can differ from what a range-based scan assumes. package-lock.json, yarn.lock, Cargo.lock, Gemfile.lock and composer.lock pin exact resolved versions, including every transitive package — which is where most real-world vulnerabilities hide. This tool's confidence meter drops when it detects ranges instead of pins.

What did Log4Shell teach about dependency scanning?

Log4Shell (CVE-2021-44228, CVSS 10.0, December 2021) was in Log4j — a library most affected teams did not know they were running because it arrived transitively. Exploitation began within hours of disclosure, and the question every CISO asked — "do we ship Log4j anywhere?" — was unanswerable without dependency inventories. It directly accelerated SBOM mandates under US Executive Order 14028. Scanning lockfiles, not just direct dependencies, is the lesson.

How often should I scan my dependencies for new CVEs?

What does a CVSS vector like AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H actually mean?

Can I scan Python, Java, Go, Rust, PHP, Ruby and .NET projects too, or only JavaScript?

Is there a free alternative to Snyk, Black Duck, Mend or JFrog Xray for dependency scanning?

Yes — this scanner is one. It queries the same class of advisory data (OSV.dev aggregates GHSA, CVE/NVD, PYSEC, RUSTSEC and the Go vulnerability database) that commercial SCA tools build on, grades findings with the full CVSS v3.1 engine, and shows the exact fixed version per advisory. The trade-off: commercial platforms add org-wide dashboards, PR bots and license policy; this tool gives you the core scan — free, no signup, no agent, no code upload.

How is this different from running npm audit, pip-audit, cargo audit, bundler-audit or govulncheck?

Those CLIs are excellent — and ecosystem-locked. npm audit only reads npm trees, govulncheck only Go, cargo audit only Rust. This page runs the same advisory lookup for eight ecosystems in one place, with no install: paste any lockfile, or check one package by name and version. It is the fastest option on a machine where you can't install tooling, during incident triage, or when you need a second opinion on a registry-specific audit.

Can I check one specific package version — say lodash 4.17.15 — without a whole lockfile?

Yes. Switch to Professional or Auditor mode and use the single-package checker: enter the package name, the exact version and its ecosystem (npm, PyPI, Maven, Go, crates.io, RubyGems, Packagist or NuGet), and you get every OSV/CVE/GHSA advisory affecting that version, its CVSS severity, and the first release that fixes it. For the record: lodash 4.17.15 is affected by CVE-2020-8203 and CVE-2021-23337 — upgrade to 4.17.21.

Can I check for the xz backdoor (CVE-2024-3094), Log4Shell or other headline CVEs here?

Yes, for anything distributed through the eight supported package ecosystems: named incidents like Log4Shell (CVE-2021-44228), Spring4Shell (CVE-2022-22965) and supply-chain compromises like event-stream or ua-parser-js all exist as OSV records, so scanning your lockfile reveals whether your exact versions are affected — including transitively. OS-level packages (the xz-utils tarball itself, Heartbleed-era OpenSSL) live outside language registries; check those with your distro's package manager or the single-package checker against the matching ecosystem build.

How do I use this in CI — can I gate a pull request on the scan?

This page is built for the human end of that loop: pre-merge spot checks, incident triage and audit evidence. For automated gating, run Google's osv-scanner (the CLI backed by the same OSV.dev database) in your pipeline and fail the build above your severity threshold — then use this page to triage what the pipeline flags, decide deploy/no-deploy with the exposure gauge, and export the JSON evidence. Same data source, so the two never disagree.

Does this satisfy the vulnerability-scanning requirements in PCI DSS, SOC 2 or ISO 27001?

It produces the technical half of the evidence: an identified-vulnerabilities report with advisory IDs, CVSS severities and remediation versions — what PCI DSS 6.2/6.3, SOC 2 CC7.1 and ISO 27001 A.12.6.1 (now A.8.8) ask you to demonstrate for third-party components. Auditor mode's JSON export is timestamped for your evidence folder. You still need the process side — documented scan cadence, remediation SLAs and exception handling — which your assessor will ask about alongside the reports.

Should I scan devDependencies too, or only production dependencies?

Scan both, but triage differently. devDependencies don't ship to production, so a vulnerable test runner rarely blocks a deploy — but build-time tooling is exactly where supply-chain attacks land (the event-stream and ua-parser-js compromises executed on developer machines and CI, not in production). Professional mode has a devDependencies toggle so you can scan the full tree, then prioritise runtime packages for SLAs while still catching malicious build-time packages.

What is software composition analysis (SCA) — and is this an SCA tool?

SCA is the practice of inventorying the open-source components in your software and checking them against known-vulnerability and license databases. This page is the security core of SCA: it builds the component inventory from your manifest, matches every name@version against the OSV.dev advisory corpus, scores each finding with CVSS v3.1 and recommends fixed versions. It deliberately skips agents, repo integrations and license policy — that's why it runs free in a browser tab.

Which vulnerabilities should I fix first when the scan finds dozens?

Order by exploitability, not just score: first anything in CISA's Known Exploited Vulnerabilities catalog or with a public exploit; then Critical (CVSS 9.0+) findings in network-reachable production packages; then High findings in your request path; then everything else batched into routine upgrades. The triage board here pre-sorts findings worst-first with fixed versions, so the top of the list is usually your literal patch order — and fixing one parent package often clears several transitive findings at once.

Have more questions? Contact us

Trusted by DevSecOps, Platform & Audit Teams

4.9

Based on 5,870 reviews

“We gate every release PR on a lockfile scan. This is the only browser tool I have found that reads the actual package-lock, resolves real OSV records with CVSS vectors, and tells the team the exact version to bump. The triage board reads like our internal SOC tooling.”

Priya Raghunathan

DevSecOps Lead, fintech platform

March 14, 2026

“Pasted a 600-line yarn.lock during an incident bridge and had the Log4Shell-style blast radius answer in under ten seconds. The privacy model matters too — legal signed off because only name@version pairs leave the browser.”

Marcus Oyelaran

Staff Platform Engineer

November 2, 2025

“I use the single-package checker constantly when triaging issues — paste name, version, ecosystem, get the GHSA/RUSTSEC aliases and the fixed release. The CVSS band table finally settled our team's endless 'is 7.5 critical?' debates.”

Elena Marchetti

Open-source maintainer (Rust + npm)

January 21, 2026

“Auditor mode exporting a JSON evidence file with advisory IDs, vectors and fixed versions saves me an hour per engagement. I would love SBOM (CycloneDX) import next, but as a zero-install pre-audit sweep it is the best free option I have tested.”

Tomás Ferreira

Independent security auditor (SOC 2 / PCI DSS)

September 18, 2025

Love using our calculator?

Related tools

Regex Tester & Builder

Build log-scrubbing & validation patterns

Diff Checker

Diff two lockfiles before & after a patch

Code Analysis Hub

All dependency & code-quality tools

SSL Analyzer

Audit your TLS config next

Learn More

Dive deeper with our expert guides and tutorials related to Package Vulnerability Scanner

Loading articles...

Reviewed against CVSS v3.1 (FIRST.org), OSV schema v1.6 and OWASP Top 10 A06:2021 · Last reviewed: 2026-06

Developers reach this page from 2,353+ different searches — from “npm audit online” and “free Snyk alternative” to “is this package version vulnerable” and “xz backdoor check”. Whatever phrasing brought you here, the workflow is the same: paste a lockfile or manifest above, and every name@version pair is matched against the live OSV.dev advisory database with CVSS v3.1 grading and exact fixed versions. Browse the related searches by topic:

Famous CVEs & supply-chain incidents56 searches

Searches sparked by named vulnerabilities and package compromises. Paste your lockfile above to check whether any of these — or the other 150,000+ OSV.dev advisories — affect your exact versions.

apache log4j security scanner
bluekeep scanner
coa compromise detection
cve 2014 0160 scanner
cve 2014 6271 scanner
cve 2017 0144 scanner
cve 2017 5638 scanner
cve 2020 1472 scanner
cve 2021 26855 scanner
cve 2021 26857 scanner
cve 2021 26858 scanner
cve 2021 27065 scanner
cve 2021 34527 scanner
cve 2021 42278 scanner
cve 2021 44228 detection tool
cve 2022 22965 scanner
cve 2022 30190 scanner
dirty cow scanner
esbackdoor detection tool
esbackdoor scanner
eternalblue scanner
event stream attack scanner
flatmap stream backdoor check
follina scanner
ghost vulnerability scanner
heartbleed detection tool
heartbleed scanner
log4j cve 2021 44228 scanner
log4j dependency scanner tool
log4j detector online
log4j scanner
log4j transitive dependency check
log4j version checker
log4j vulnerability check
log4shell detection tool
log4shell patch checker
log4shell scanner
log4shell vulnerable dependency check
printnightmare scanner
proxylogon scanner
proxyshell scanner
samaccountname scanner
shellshock detection tool
shellshock scanner
spring4shell detection tool
spring4shell scanner
ua parser js compromise scanner
xz backdoor check tool
xz backdoor dependency check
xz backdoor detection
xz backdoor scanner
xz utils backdoor detection
xz utils backdoor scanner
xz utils cve 2024 3094
xz utils cve scanner
zerologon scanner

Free alternatives & tool comparisons118 searches

This scanner is a free, no-signup, in-browser answer to every "alternative" and "vs" search below — same OSV.dev advisory data many commercial SCA tools build on.

alternative to commercial sca tools
best free alternative to snyk
best free vulnerability scanner vs paid
black duck alternative free
black duck scanner alternative
black duck vs snyk
bundle audit alternative
bundle audit online
bundler audit online
bundler audit tool
bundler audit vs snyk
cargo audit alternative
cargo audit online
cargo audit tool
cargo audit vs snyk
cargo crev proof viewer
cargo vet online alternative
checkov scanner online
compare free vulnerability scanners
comparison of open source security scanners
composer audit alternative
composer audit online
dependabot alternative free
dependabot security scan
dependabot vs snyk
deps.dev alternative
deps.dev vulnerability scanner
free alternative to jfrog xray
free dependency check like whitesource
free dependency scanner like snyk
free security scanner like snyk
free tool instead of snyk
github dependabot alternative
gitlab dependency scanner alternative
govulncheck alternative
govulncheck online
govulncheck vs snyk
govulncheck web
grype alternative online
grype scanner web
is there a free alternative to snyk for dependency scanning
jfrog vulnerability scanner alternative
jfrog xray alternative free
jfrog xray vs snyk
laravel composer audit
mend bolt alternative
mend io scanner alternative
nexus vulnerability scanner alternative
node security platform alternative
node security project scanner
npm audit alternative
npm audit fix preview scanner
npm audit free tool
npm audit online
npm audit online alternative
npm audit report online
npm audit results viewer
npm audit scanner
npm audit tool online
npm audit vs pnpm audit
npm audit vs scanner
npm audit vs yarn audit
npm audit vulnerabilities
open source alternative to black duck
open source replacement for whitesource
open source snyk replacement
osv scanner alternative
osv.dev vs nvd
osv.dev vs snyk
owasp dependency check alternative
owasp dependency check free
owasp dependency check online
owasp dependency check tool
owasp dependency check vs retire.js
package safety check
pip audit alternative
pip audit online
pipenv check alternative
pnpm audit alternative
pnpm audit online
pnpm audit results viewer
python package safety check
rails bundle audit security
retire js scanner alternative
retire.js alternative
safety check python alternative
safety db python vulnerabilities
safety db scanner alternative
safety vs snyk
scan after dependabot update
self hosted snyk alternative
snyk alternative free
snyk competitor free
snyk free alternative
snyk open source alternative
snyk pricing alternative
snyk scanner alternative
snyk test npm alternative free
snyk vs deps.dev
snyk vs grype
snyk vs npm audit
snyk vs owasp dependency check
snyk vs socket.dev
snyk vs trivy
socket.dev alternative free
sonatype dep check alternative
synopsys dependency check alternative
trivy alternative online
trivy scanner web
trivy vs anchore
trivy vs clair
trivy vs grype
vulnerability scanner with compare
whitesource alternative free
whitesource bolt alternative
whitesource vs snyk
yarn audit alternative
yarn audit tool

CVE, OSV, NVD & advisory database lookups134 searches

Every scan queries the live OSV.dev database, which merges CVE, NVD, GitHub Security Advisories (GHSA), PYSEC, RUSTSEC and the Go vulnerability database into one record per flaw.

advisory database search
advisory feed aggregator for developers
automated cve scanner
cloud based cve checker
critical cve check now
critical cve detector
critical cve finder
cve check tool
cve checker
cve checker for devops
cve checker for energy sector
cve checker for fortune 500
cve checker for incident response
cve checker for saas company
cve checker tool
cve database lookup
cve database search
cve detector
cve finder
cve lookup
cve lookup for auditor
cve lookup for risk manager
cve lookup tool
cve lookup tool for package maintainers
cve scan tool
cve scanner
cve scanner 2024
cve scanner 2025
cve scanner for apis
cve scanner for microservices
cve scanner for serverless
cve scanner for web apps
cve scanner free
cve scanner online
cve scanner online free
cve scanner tool
cve scanner tool free
cve scanning tutorial
cve search
cve search tool
cve vulnerability database
cve vulnerability scanner
cve.org search by package name
dotnet cve scanner
epss score lookup for cve
exploit code availability checker
exploit database check
free cve checker online
free cve scanner
ghsa scanner
github advisory database search
github security advisory scanner
github security advisory search tool
go cve checker
go osv scanner
go vulnerability database
golang cve scanner
google osv scanner
google osv scanner tool
google security advisory scanner online
hex pm cve lookup
immediate cve lookup tool
individual dependency advisory lookup
individual library cve scan
intelligent cve finder
known vulnerability search by ecosystem
library name version cve check
maven cve scanner
mitre attack dependency security tactic
mitre cve identifier search tool
mitre cve lookup
mitre subtechnique package security
mitre technique dependency security
national vulnerability database lookup
national vulnerability database search
nist nvd scanner
npm cve check
npm cve scanner
nvd cve lookup
nvd scanner
nvd vulnerability search
one dependency advisory scanner
one library cve checker
online cve scanner
open source cve checker
open source vulnerability database search
osv advisory search
osv advisory search tool
osv cve lookup online
osv cve mapper
osv database lookup
osv database query tool
osv scanner
osv scanner online
osv schema vulnerability scanner
osv vulnerability lookup
osv vulnerability scanner
osv.dev api scanner
osv.dev browser scanner
osv.dev dependency check
osv.dev free scanner
osv.dev go scanner
osv.dev java scanner
osv.dev npm scanner
osv.dev python scanner
osv.dev rust scanner
osv.dev scanner
osv.dev security tool
osv.dev web based scanner tool
osv.dev web scanner
package at version cve lookup
package cve lookup
php cve scanner
python cve lookup tool
python cve scanner
python known vulnerability database
python osv scanner
real time cve detector
ruby cve scanner
rubygems advisory database lookup
rust cve scanner
saas cve checker
security advisory lookup
security advisory scanner
security advisory search for developers
single library cve lookup
smart cve detector
spring framework cve scanner
vulnerability advisory tool
vulnerability database browser interface
vulnerability scanner with github advisory
vulnerability scanner with osv data
where to check for cve
where to find vulnerability database

Compliance, standards & audit evidence51 searches

Auditor mode exports a JSON evidence file with advisory IDs, CVSS vectors and fixed versions — the artefact assessors ask for under PCI DSS 6.2, SOC 2 CC7.1, ISO 27001 A.12.6.1, HIPAA, GDPR Art. 32, NIST SSDF, EO 14028 and the EU Cyber Resilience Act.

Fortune 500 dependency adoption
accreditation package security evidence
attestation package security statement
audit trail package security log
certification dependency security requirement
cis controls software inventory vulnerability scanner
cisa kev check
cisa known exploited vulnerabilities scanner
cisa known exploited vulnerability check
compliance audit dependency check
compliance ready dependency vulnerability scanner
cyber insurance requirement dependency scanner
dependency audit for compliance officer
dependency scanner for cyber insurance
eu cyber resilience act dependency scanning tool
eu cyber resilience act dependency security scanner
executive order 14028 dependency scanning
gdpr article 32 dependency security scanner
hipaa technical safeguard dependency scanner
how to meet executive order 14028 dependency requirements
iso 27001 a12.6.1 technical compliance vulnerability tool
known exploited vulnerabilities check
merger acquisition software security scanner
nist csf dependency check
nist ssdf dependency security scanner
npm attestation checker
open source compliance audit
owasp a06 2021 vulnerability scanning
owasp scanner online
owasp top 10 vulnerable and outdated components scanner
pci dss 6.2 vulnerability scanner for dependencies
pre ipo security audit dependency check
regulatory dependency scan
security due diligence on open source
security scanner for compliance teams
soc 2 cc7.1 vulnerability detection tool
software composition analysis for security compliance
sox compliance dependency audit
specification compliance security check
vendor security assessment questionnaire
vulnerability scanner with cis benchmark
vulnerability scanner with cisa kev
vulnerability scanner with compliance
vulnerability scanner with gdpr
vulnerability scanner with hipaa check
vulnerability scanner with iso 27001
vulnerability scanner with nist mapping
vulnerability scanner with owasp mapping
vulnerability scanner with pci dss
vulnerability scanner with soc 2
vulnerability sla compliance checker

SBOM, CycloneDX & SPDX scanning32 searches

Software bill of materials searches — generate your SBOM with your build tool, then validate the package list here against live advisories.

cyclonedx json validator security
cyclonedx sbom vulnerability scanner online
cyclonedx scanner
cyclonedx vulnerability scanner
how to audit software bill of materials for cve
how to generate sbom for vulnerability scanning
java sbom scanner
npm bill of materials security
npm sbom scanner
python sbom generator
rust sbom generator
sbom audit tool
sbom based vulnerability scanner free tool
sbom completeness scanner free
sbom quality checker online
sbom scanner
sbom security audit
sbom security scanner
sbom vulnerability check
sbom vulnerability scanner
sbom.json scanner
software bill of materials scanner
software bill of materials validator
software bom security check
spdx sbom security scan
spdx sbom security scanner tool
spdx tag value security scanner
spdx vulnerability scanner
vulnerability scanner with cyclonedx export
vulnerability scanner with sbom generation
vulnerability scanner with spdx export
what is sbom scanning

CI/CD, DevSecOps & release gating216 searches

Teams wire this scan into pull-request review, pre-deploy checks and release gates. The exposure score gives you a clean block/ship threshold for any pipeline.

Cargo.lock scanner
Cargo.toml scanner
Cargo.toml vulnerability check
argo cd security scanner
audit before production
audit my repository
aws codebuild security scanner
aws lambda dependency scanner
azure devops security scan
azure devops vulnerability scanner
azure function dependency check
azure pipeline vulnerability scan
azure pipelines security scanner
before merge security gate
bitbucket pipeline dependency audit
bitbucket pipeline vulnerability scan
bitbucket vulnerability scanner
block deploy on critical cve
cargo install security check
cargo lock security scan
cargo lock vulnerability
cargo lock vulnerability scanner free
cargo security audit
cargo toml vulnerability check
cargo vulnerability scanner
cargo workspace security scanner
cargo.lock vulnerability scanner
cd pipeline security check
check before deploying to production
check before release
check code for security flaws
check dependencies after renovate
check deployment for alerts
check import for flaws
check my repository security
ci cd vulnerability scanner
ci pipeline vulnerability scan
ci vulnerability scanner
circleci orb security scanner
circleci vulnerability scan
cloud based dependency scanner
cloud based security scanner
cloud based vulnerability scanner
cloud native cve monitor
cloud native dependency scanner
cloud native security scanner
cloud native vulnerability scanner
cloudflare pages security audit
cloudflare worker dependency check
container base image vulnerability scanner
container image dependency scan
container vulnerability scanner
continuous cve monitor
continuous dependency checker
continuous dependency scanner
continuous dependency security monitoring
continuous package auditor
continuous security scanner
continuous vulnerability scanner
deno deploy security scan
dependency checker for ci
deployability package security install
detect flaws in manifest
detect flaws in my supply chain
detect risks in deployment
detect security flaws in build
devops vulnerability scanner
devsecops dependency check
devsecops vulnerability scanner
digital ocean security check
discover flaws in my toolkit
docker compose dependency check
docker compose security scan
docker image dependency scan
docker vulnerability scanner
dockerfile dependency scanner
dockerfile vulnerability scanner
drone ci dependency audit
edge function security scanner
entry point package security gateway
expose flaws in my app
find alerts in deployment
find flaws in import
find flaws in my packages
find security flaws in code
flag flaws in my infrastructure
flux cd dependency check
fly.io security audit
gate deployment on vulnerability score
gateway dependency security portal
git repository vulnerability scanner
github action dependency check
github actions vulnerability scan
github actions vulnerability scanner
github marketplace security scanner
github vulnerability alert tool
github vulnerability scanner
gitlab ci security audit
gitlab ci vulnerability scanner
gitlab pipeline security scan
gitlab plugin vulnerability scanner
gitlab vulnerability scanner
google cloud build security
google cloud function security
guard my app against security flaws
guard my deployment against exposure
harden my app against security flaws
harden my deployment against exposure
helm chart dependency security
helm chart vulnerability scanner
heroku security scanner
how does github check for vulnerable dependencies
how to audit cargo dependencies
how to check express.js version for security flaws
how to detect security flaws
how to integrate security scanner in ci
hunt for security flaws in libraries
identify flaws in my components
infrastructure as code security scanner
inspect my dependencies for flaws
jenkins pipeline vulnerability scan
jenkins vulnerability scanner
jenkinsfile security scanner
k8s dependency security
kubernetes manifest dependency scan
kubernetes manifest security check
kubernetes vulnerability scanner
lambda dependency vulnerability
lerna monorepo security audit
merge request security check
monorepo dependency vulnerability scanner
monthly vulnerability assessment
netlify build security scan
netlify function security scan
new repo vulnerability check
nightly vulnerability scan
npm ci security audit
nx monorepo vulnerability scanner
on demand vulnerability scan
package auditor for github
package json requirements txt pom xml go mod cargo toml scanner
package scanner for cargo
platform as a service security scanner
pr vulnerability scanner
pre commit vulnerability check
pre deploy vulnerability scan
pre deployment vulnerability scan
pre merge security scan
pre release security check
prevent exposure in my deployment
prevent security flaws in my app
production incident dependency scan
production security audit
protect my app from security flaws
protect my deployment from exposure
pull request security scan
pull request vulnerability gate
pulumi security audit
quick way to scan my code dependencies for security flaws
railway security scanner
remediate go module flaws
render security check
renovate bot security check
repo vulnerability scanner
repository vulnerability scanner
reveal flaws in my repository
reveal threats in my pipeline
saas dependency scanner
saas security scanner
saas vulnerability scanner
safeguard my app from security flaws
safeguard my deployment from exposure
scan before deploy
scan cargo lock for cve
scan cargo toml for vulnerabilities
scan dependencies before merge
scan deployment for threats
scan gemfile lock for flaws
scan go sum for flaws
scan my cargo lock online
scan my node_modules for flaws
scan my repository for threats
scan on every pull request
scan package list for flaws
scan packages config for flaws
scan pnpm lock for flaws
scan pom xml for flaws
scan software for flaws
search for security flaws in project
search for vulnerabilities in repository
secure my app from security flaws
secure my deployment from exposure
security gate for releases
security gate policy enforcer
security scanner for devops
security scanner for devops engineers
serverless dependency scanner
serverless function dependency vulnerability
shift left security tool
shift left vulnerability scanner
should i block deployment for a high severity cve
stop vulnerable packages in ci
summation dependency security aggregate
terraform dependency check
terraform module security scan
travis ci security scan
travis yaml security scan
turborepo dependency security check
uncover flaws in my application
vercel build security check
vercel edge function security
vulnerability scan in staging
vulnerability scanner with gate
weekly dependency security audit
what cve severity level should fail my ci pipeline
where to check if cargo lock has known vulnerabilities

npm, Node.js & JavaScript ecosystem167 searches

package.json, package-lock.json (v1–v3), yarn.lock and pnpm/bun searches — all parsed in-browser and matched against GHSA and CVE records for npm.

analyze my node_modules risks
angular security audit
assess my node_modules exposure
audit my node_modules
bun install security scan
bun.lockb vulnerability scanner
can i check if a specific npm package version is safe
capacitor plugin security
check my node_modules status
check npm package vulnerabilities online
check software for exposure
cordova plugin security scanner
detect exposure in module
disclosure package security exposure
drop my package json to scan
easiest way to check npm vulnerabilities
electron app dependency scanner
evaluate my node_modules health
expo dependency security check
export vulnerability results json
expose issues in my system
expose risks in my modules
expose threats in my code
exposure score calculator for dependency vulnerabilities
express js vulnerability scanner
find exposure in software
fix vulnerable npm packages
free npm vulnerability scanner
free online dependency vulnerability scanner for npm
frontend backend combined security scan
frontend dependency security
gauge my dependency exposure
gauge my node_modules threat
how can i check if my node modules are secure
how do i know if my npm packages are safe
how to audit npm packages
how to calculate my project's vulnerability exposure
how to check npm vulnerabilities
how to scan node_modules
hunt for exposure in imports
inspect my node_modules for issues
ionic dependency security check
is lodash 4.17.15 vulnerable security checker
is my npm package vulnerable
is there a way to scan my package lock for security issues
is this react version safe to use vulnerability check
javascript dependency scanner
javascript library vulnerability
javascript package vulnerability
javascript security scanner
js dependency audit
js security audit
lockfile scanner for node
look up exposure for import
malicious npm package scanner
manifest scanner for javascript
manifest scanner for typescript
measure my node_modules exposure
minimum safe version for vulnerable npm package
nest js security audit
next js vulnerability scan
node js security scanner
node js vulnerability scanner
node_modules security audit
node_modules vulnerability scanner
npm dependency audit
npm dependency check online free
npm dependency health check
npm dependency risk scanner
npm dependency security
npm dependency vulnerability
npm deprecated package scanner
npm install security warning
npm known vulnerabilities
npm malicious package detector
npm outdated security check
npm outdated vulnerable packages
npm package behavior analyzer
npm package integrity check
npm package provenance verification
npm package risk assessment
npm package security scanner
npm package security verification
npm package vulnerability scanner
npm publish security check
npm pypi maven go rust php ruby dotnet scanner
npm security 2024
npm security audit
npm security audit online tool
npm security check
npm security scan
npm security scan online free
npm signature verification scanner
npm supply chain security
npm transitive dependency vulnerability
npm update security scanner
npm vulnerability check
npm vulnerability report generator
npm vulnerability scanner
nuxt vulnerability check
package lock json vulnerability
package lock json vulnerability scanner free
package lock security scan
package lock vulnerability check
package scanner for npm
package-lock.json scanner
package-lock.json security audit
package-lock.json vulnerability scanner
package.json scanner
package.json security audit
package.json security check
package.json vulnerability check
package.json vulnerability scanner
paste my package json to scan
paste package lock scan
pnpm lock vulnerability
pnpm outdated security check
pnpm security scan
pnpm vulnerability scanner
pnpm workspace vulnerability scanner
pnpm-lock.yaml scanner
react dependency vulnerability
react native dependency scanner
react native security audit
reaction dependency security feedback
remediate npm vulnerabilities
response package security reaction
review my node_modules status
rush security audit
rush stack dependency security scan
scan import for exposure
scan my package json online
scan my package lock json free
scan my yarn lock online
scan node js vulnerabilities
scan node project vulnerabilities
scan npm dependencies for vulnerabilities
scan package json for vulnerabilities
scan package lock for cve
scan yarn lock for security issues
search for exposure in platform
single tool to check npm python java go rust php ruby dotnet
test my node_modules for known cve
tool that scans package json for security issues in browser
typescript dependency scanner
upload my package json for scan
validate my node_modules safety
vue dependency vulnerability
vulnerability exposure calculator
vulnerability exposure score
vulnerability scanner with export
vulnerability scanner with exposure score
vulnerability scanner with json export
what is my vulnerability exposure
what tool do people use to scan npm dependencies
works with npm python java go rust
yarn berry security audit
yarn install security scan
yarn lock security audit
yarn lock vulnerability check
yarn lock vulnerability scanner free
yarn pnp security scanner
yarn security check
yarn vulnerability scanner
yarn workspace security audit
yarn.lock scanner
yarn.lock vulnerability scanner

Python & PyPI ecosystem76 searches

requirements.txt scanning against PYSEC, GHSA and CVE advisories — plus the searches developers run for poetry, pipenv, conda and Django/Flask/FastAPI projects.

Pipfile.lock scanner
are my python packages secure
check if django version has known vulnerabilities
check requirements for warnings
conda install security audit
conda security audit
conda vulnerability scanner
detect risks in requirements
django vulnerability scanner
fastapi security scan
find warnings in requirements
fix vulnerable python dependencies
flask vulnerability scanner
free online dependency vulnerability scanner for python
free python vulnerability scanner
free website to paste requirements txt and check vulnerabilities
how to check python dependencies
how to scan requirements.txt
how to see if my python packages have known cve
hunt for warnings in requirements
is this python package version affected by any cve
lockfile scanner for python
look up warning for requirements
malicious pypi package detector
manifest scanner for python
micromamba security scanner
package scanner for pypi
pip dependency check
pip install security check
pip list vulnerability scanner
pip security audit
pip vulnerability scanner
pipenv security audit
pipenv vulnerability scanner
pipfile lock vulnerability
poetry install security scan
poetry lock security scan
poetry lock vulnerability
poetry.lock scanner
poetry.lock vulnerability scanner
pyenv security dependency check
pypi package anomaly detector
pypi package vulnerability
pypi security audit
pypi vulnerability scanner
pyproject.toml vulnerability scanner
python dependency scanner
python dependency security
python dependency vulnerability checker
python library vulnerability scanner
python package risk scanner
python package vulnerability
python requirements scanner
python security 2024
python security audit tool
python security scanner
python supply chain security
python transitive dependency vulnerability
python vulnerability checker
python vulnerability scanner
remediate python cve
requirements lock vulnerability
requirements txt security scan
requirements txt vulnerability
requirements txt vulnerability scanner free
requirements.lock scanner
requirements.txt scanner
requirements.txt security audit
requirements.txt vulnerability scanner
scan my requirements txt free
scan pipfile lock for security issues
scan poetry lock for cve
scan requirements for cve
scan requirements txt for vulnerabilities
setup.py security check
uv security scanner rust

Java, Maven & JVM ecosystem70 searches

pom.xml scanning with transitive-dependency awareness — the searches teams ran during Log4Shell, plus Gradle, Kotlin, Scala and Spring coverage.

ant ivy security scanner
build gradle vulnerability
build.gradle scanner
build.gradle security check
clojure deps security scanner
escalation package security increase
fix vulnerable java libraries
free java vulnerability scanner
free online dependency vulnerability scanner for java
gradle dependencies security scan
gradle lockfile vulnerability
gradle multi project security scan
gradle security audit
gradle vulnerability scanner
gradle.lockfile scanner
gradle.lockfile vulnerability scanner
how to audit java dependencies
how to scan pom.xml
how to verify spring boot version security status
is my java project safe
jakarta ee dependency scanner
java dependency scanner
java jar vulnerability scanner
java library vulnerability
java package vulnerability scanner
java security scanner
java security trends 2024
java supply chain security
java vulnerability scanner
java war vulnerability scan
javafx dependency vulnerability
jpackage security audit
kotlin dependency security
kotlin dependency vulnerability
kotlin vulnerability scanner
ktor security scanner
leiningen vulnerability check
lockfile scanner for java
manifest scanner for java
manifest scanner for kotlin
maven dependency check
maven multi module vulnerability scanner
maven package vulnerability
maven security audit
maven transitive dependency scan
maven vulnerability scanner
mvn dependency tree security
mvn dependency vulnerability
online scanner for pom xml security issues
package scanner for maven
play framework security scanner
pom xml security scan
pom xml vulnerability check
pom xml vulnerability scanner free
pom.xml scanner
pom.xml vulnerability scanner
quarkus extension security
remediate java security issues
sbt dependency check plugin
sbt security audit
scala dependency vulnerability scanner
scalability package security growth
scan build gradle for vulnerabilities
scan gradle lockfile for cve
scan my pom xml free
spring boot vulnerability scanner
spring dependency management security
spring security audit
tool to check if my java libraries have vulnerabilities
war room vulnerability scanner

Go modules ecosystem40 searches

go.mod scanning against the official Go vulnerability database (vuln.go.dev) and CVE records — a browser-based answer to govulncheck searches.

are my go modules vulnerable
browser based tool to check go mod for cve
fix vulnerable go modules
free go vulnerability scanner
free online dependency vulnerability scanner for go
go dependency scanner
go get security check
go library vulnerability
go mod security check
go mod vulnerability check
go mod vulnerability scanner free
go module security audit
go module vulnerability scanner
go package risk scanner
go package vulnerability
go security ecosystem
go security scanner
go sum security audit
go sum vulnerability
go supply chain security
go transitive dependency scan
go vulnerability scanner
go work security scan
go workspace vulnerability scanner
go.mod scanner
go.mod vulnerability scanner
go.sum scanner
go.sum vulnerability scanner
golang security audit tool
golang vulnerability scanner
how to check go modules security
how to scan go.mod
lockfile scanner for go
manifest scanner for golang
package scanner for golang
paste and go vulnerability scanner
scan go mod for security issues
scan my go mod online
vuln check go online
website to scan my go modules for cve

Rust & crates.io ecosystem25 searches

Cargo.lock scanning against RUSTSEC and CVE advisories for every crate in your dependency tree.

check my rust dependencies
crates.io vulnerability scanner
dependability package security trustworthy
dependency trust score evaluator
fix vulnerable rust crates
free online dependency vulnerability scanner for rust
free rust vulnerability scanner
how to check rust packages
lockfile scanner for rust
manifest scanner for rust
online tool to check rust crate security
package trust verification
rust crate vulnerability scanner
rust dependency scanner
rust library vulnerability
rust package vulnerability
rust security ecosystem
rust security scanner
rust supply chain security
rust transitive dependency scan
rust vulnerability scanner
rustup component security
trusted package verifier
trusted vulnerability scanner
trustworthiness dependency security integrity

Ruby & RubyGems ecosystem38 searches

Gemfile.lock scanning against GHSA and CVE records — a zero-install alternative to bundler-audit searches.

Gemfile.lock scanner
Gemfile.lock vulnerability scanner
audit my ruby gems
bundle install security check
bundler security scan
check bundle for cve
detect threats in bundle
discover cve in my bundles
find cve in bundle
fix vulnerable ruby gems
flag risks in my bundles
free online dependency vulnerability scanner for ruby
free online gemfile lock security scanner
free ruby vulnerability scanner
gem install security audit
gemfile lock security scan
gemfile lock vulnerability
gemfile lock vulnerability scanner free
gemfile vulnerability scanner
how to audit gemfile
how to audit ruby gems for known vulnerabilities
how to check ruby dependencies
hunt for cve in bundles
lockfile scanner for ruby
look up cve for bundle
manifest scanner for ruby
package scanner for rubygems
rails security audit
rails vulnerability scanner
ruby dependency scanner
ruby gem vulnerability scanner
ruby library vulnerability
ruby package vulnerability
ruby security scanner
ruby vulnerability scanner
scan bundle for vulnerabilities
scan gemfile for security issues
scan my gemfile lock free

PHP & Composer ecosystem37 searches

composer.lock scanning (including packages-dev) against Packagist advisories, GHSA and CVE.

composer install audit security
composer json vulnerability
composer lock security scan
composer lock vulnerability
composer lock vulnerability scanner free
composer require security check
composer security audit
composer vulnerability scanner
composer.json scanner
composer.json vulnerability check
composer.lock scanner
composer.lock vulnerability scanner
fix vulnerable php packages
free online dependency vulnerability scanner for php
free php vulnerability scanner
free tool to scan my php composer packages
how to check php dependencies
how to scan composer.lock
laravel vulnerability scanner
lockfile scanner for php
manifest scanner for php
package scanner for composer
packagist vulnerability scanner
php artisan security scan
php dependency scanner
php library vulnerability
php package vulnerability
php security scanner
php supply chain security
php transitive dependency scan
php vulnerability scanner
scan composer json for vulnerabilities
scan composer lock for cve
scan my composer lock online
scan my php libraries
symfony security audit
tool to check composer lock for vulnerabilities without install

.NET & NuGet ecosystem37 searches

.csproj and packages.config scanning against GHSA and CVE records for NuGet packages.

.csproj scanner
.csproj vulnerability scanner
.net vulnerability scanner
asp.net vulnerability scanner
best way to check dotnet nuget package security
c# dependency scanner
c# security scanner
check my dotnet packages
csharp vulnerability scanner
csproj vulnerability check
csproj vulnerability scanner free
dotnet add package security
dotnet core security audit
dotnet dependency check
dotnet list package security
dotnet supply chain security
dotnet vulnerability scanner
fix vulnerable dotnet packages
free dotnet vulnerability scanner
free online dependency vulnerability scanner for dotnet
how to check dotnet dependencies
how to scan nuget packages
lockfile scanner for dotnet
manifest scanner for csharp
nuget install security check
nuget package vulnerability
nuget security audit
nuget transitive dependency scan
nuget vulnerability scanner
package scanner for nuget
packages config vulnerability
packages.config scanner
packages.config vulnerability scan
paket security scanner
scan csproj for security issues
scan my csproj free
website that checks nuget packages for security issues

Other languages, OS packages & platforms114 searches

Searches from neighbouring ecosystems. This scanner focuses on the eight OSV-backed ecosystems above; for OS packages and the platforms below, it remains the fastest way to check any package by name and version via the single-package checker.

10 file formats auto detected scanner
10 file formats vulnerability scanner
adaptability package security flexibility
agility package security nimbleness
alpine linux package vulnerability
apt dependency security actor
apt package vulnerability scanner
arch linux package vulnerability
auth library vulnerability scan
auto detect format scanner
auto detect format security scanner
c library vulnerability scanner
cabal vulnerability scanner
centos dependency security check
chocolatey package vulnerability
cmake dependency security
cocoapods vulnerability scanner
community driven cve tracker
community driven dependency scanner
community driven security scanner
community driven vulnerability scanner
community health security indicator
community size security indicator
conan dependency security scanner
conformance test security result
cpp dependency vulnerability scanner
cran security scanner
cross platform vulnerability scanner
crypto library security audit
crystal dependency vulnerability
crystal shards security scanner
dart pub security scanner
database driver vulnerability
debian package security check
deno dependency security
dependency freshness evaluator
discover risks in my platform
elixir hex security scanner
embedded dependency security scanner
embedded supply chain security
erlang dependency vulnerability
erlang security scanner
evaluate my dependency posture
evaluate my lockfile status
evaluate my package safety
firmware dependency security check
flutter dependency vulnerability
flutter package security audit
flutter plugin vulnerability
game engine dependency vulnerability
gnu dependency security
godot addon security scanner
graphql dependency security
gtk dependency security scanner
hackage security scanner
haskell dependency vulnerability
homebrew package security scanner
how to perform security scan
http client vulnerability check
ios dependency security audit
iot library vulnerability
julia dependency vulnerability
julia registry security scanner
linux package vulnerability scanner
logging library security scan
lua rocks security scanner
luarocks vulnerability check
mock library security audit
multi format vulnerability scanner
multi lockfile format scanner
native script security scanner
nim dependency vulnerability
nimble security scanner
nix package security scanner
no signup vulnerability scanner
ocaml dependency vulnerability
opam security scanner
operating system package vulnerability scan
opportunity dependency security chance
opportunity dependency security condition
orm dependency security check
parser vulnerability check
possibility package security opportunity
protocol implementation security scan
pub dev vulnerability scanner
qt dependency vulnerability
r dependency vulnerability
r package security audit
red hat package security scanner
reference implementation vulnerability
security scanner for platform engineer
serialization vulnerability scanner
specific library version cve
spm security check
strategic dependency risk evaluation
supply chain threat intelligence platform
swift dependency security check
swift package vulnerability scanner
tauri app security check
template engine vulnerability
test framework vulnerability
third party software security evaluation
ubuntu package vulnerability
unity package security scanner
unreal engine plugin security
vcpkg security check
vulnerability scanner no signup
vulnerability scanner with format detection
websocket dependency scan
wxwidgets security audit
xcode dependency security scanner
yum package security scanner
zig dependency vulnerability
zig package security scanner

Private, in-browser & no-upload scanning55 searches

The most common worry behind these searches: "do I have to upload my code?" Here, no. Parsing is 100% client-side; only package names and versions are queried against OSV.dev. No account, no install, no signup.

anonymous vulnerability scanner
browser based vulnerability scanner
browser only dependency check
can i check vulnerabilities locally
can i scan my lockfile online without uploading code
can i scan without uploading code
client only vulnerability scanner
client side parsing vulnerability
client side vulnerability scanner
code never leaves machine scanner
confidential security audit tool
copy paste vulnerability scanner
dependency checker that runs locally
drag drop vulnerability scanner
drop everything security check
drop file vulnerability scanner
drop my lockfile to check
fully in browser security tool
how to check my project dependencies without installing anything
in browser security scanner
local development security scan
local vulnerability scanner
lockfile scanner 100 percent client side
manifest security scanner no server upload
no account dependency scanner
no download vulnerability scanner
no install vulnerability scanner
no registration security scanner
no setup security scanner
offline capable vulnerability scanner
package auditor that keeps code private
paste and scan vulnerability
paste lockfile vulnerability check
paste manifest security scan
paste my lockfile to check
privacy first dependency scanner
privacy first vulnerability scanner
privacy preserving vulnerability scanner
private vulnerability scanner
security scanner that parses in browser
upload and scan vulnerability
upload my lockfile for check
vulnerability scanner browser based
vulnerability scanner client side
vulnerability scanner no install
vulnerability scanner no registration
vulnerability scanner without installation
web based dependency scanner
web based security audit
web based vulnerability scanner
where can i paste my lockfile to check for vulnerabilities
works in browser only scanner
zero config vulnerability scanner
zero install security scanner
zero upload vulnerability scanner

CVSS scores, severity & risk prioritization108 searches

Every finding is graded on the CVSS v3.1 scale with the full base-score engine documented on this page — including the 0–100 exposure score, severity bands and fix-first ordering.

api stability security metric
assess my dependency risks
asset criticality vulnerability matrix
bus factor dependency risk
check dependency for risks
check project for risks
concentration risk dependency scanner
context aware vulnerability scoring
cvss base score calculator
cvss calculator
cvss score calculator
cvss scoring guide for developers
cvss scoring tool
cvss severity calculator
cvss severity rating calculator for cve findings
cvss v3 calculator
cvss v3.1 calculator
dependency maintenance burden scorer
dependency risk analysis
dependency risk assessment training
dependency risk audit
dependency risk heat map generator
dependency risk report tool
dependency risk scanner
dependency risk scoring methodology
dependency security kpi tracker
detect risks in my software
dev dependency security risk
find risks in dependency
find risks in my libraries
find risks in project
gauge my package risk
guard my software against risks
harden my software against risks
high severity vulnerability scanner
how many high severity issues are too many
how serious is a medium severity cve in my dependency
how to calculate risk from cve
how to interpret cvss v3.1 scores for dependencies
how to prioritize vulnerabilities
how to set vulnerability thresholds for my project
how to triage cve findings in my dependencies
how to triage security findings
hunt for risks in modules
identify risks in my system
inherent risk dependency security
inspect my packages for risks
library risk assessment
likelihood dependency security probability
look up risk for module
lookup table for cvss scores and severity levels
magnitude package security severity
mean time to patch measurement
measure my package risk
open source component risk matrix
open source risk audit
open source security scorecard
open source supply chain risk
organizational resilience package metric
package reputation score checker
package risk assessment tool
package security score calculator
prevent risks in my software
prioritization package security rank
probability package security chance
project security health metrics
protect my software from risks
quantitative vulnerability risk assessment
residual risk package security
reveal risks in my build
risk acceptance dependency security
risk based vulnerability prioritization
safeguard my software from risks
scan build for risks
scan lock file for risks
scan my manifest for risks
search for risks in application
secure my software from risks
security metrics for open source
security program metrics dashboard
security scoring methodology for packages
stale dependency security risk
supplier consolidation risk scanner
sustainability score dependency
test my lockfile for security risks
third party risk assessment
uncover risks in my codebase
vulnerability dwell time calculator
vulnerability exploitation likelihood
vulnerability prioritization tool
vulnerability probability score checker
vulnerability risk matrix calculator
vulnerability risk scoring tool
vulnerability scanner with cvss
vulnerability scanner with metrics
vulnerability scanner with prioritization
vulnerability scanner with risk score
vulnerability scanner with severity score
vulnerability scanner with threshold
vulnerability scanner with triage
vulnerability severity rating tool
vulnerability triage tool
what does a cvss score of 7.5 mean for my project
what is an acceptable level of dependency risk
what is cvss score
what is the cvss score meaning
what is transitive dependency risk
what is vulnerability severity

Supply-chain attacks & malicious packages90 searches

Typosquatting, dependency confusion, hijacked maintainer accounts and backdoored releases all end up as OSV/GHSA advisories (the xz backdoor is CVE-2024-3094) — which is exactly what this scan surfaces.

active exploitation scanner for cve
analyze my lockfile integrity
anomaly detection in dependency changes
anomaly package security deviation
assess my package threats
backdoor package scanner
behavioral analysis of package updates
botnet package scanner
brand impersonation package scanner
chaos package security confusion
check app for threats
check my packages integrity
check package for threats
command and control package security
compromise assessment dependency scanner
compromise package security infiltration
credential stealer package scanner
crypto miner dependency detector
dependency confusion attack prevention
dependency confusion prevention tool
dependency supply chain security
dependency threat assessment
detect threats in library
detect threats in my packages
discover threats in my framework
exfiltration dependency security data loss
exploitable vulnerability detection
exploitation package security leverage
fake download count detector
find threats in app
find threats in my modules
find threats in package
flag threats in my releases
guard my build against threats
harden my build against threats
hunt for threats in components
identify threats in my app
in the wild exploit detection
integrity package security wholeness
ioc matching for package vulnerabilities
kill chain dependency security phase
library integrity check
look up threat for component
malicious package scanner
measure my lockfile integrity
namespace confusion scanner
namespace squatting detector
package hijacking detection
package integrity check
package integrity validator
package takeover scanner
phantom dependency security scanner
pivot dependency security lateral
prevent threats in my build
proof of concept exploit detector
protect my build from threats
ransomware dependency scanner
reconnaissance dependency security gather
safeguard my build from threats
scan manifest for threats
search for threats in system
secure my build from threats
shadow dependency detection
software supply chain scanner
software supply chain security
software supply chain security course
spyware package scanner
star jacking detection tool
supply chain attack prevention
supply chain hygiene checker
supply chain security assessment tool
supply chain security scanner
supply chain security tool
supply chain vulnerability scanner
tampering package security modification
threat actor package security profile
threat hunting in dependency tree
threat intelligence for dependencies
typo squatting detection tool
typosquatting package scanner
uncover threats in my infrastructure
unexpected package install security alert
validate my package integrity
vulnerability scanner with exploit check
vulnerability scanner with typosquatting
weaponization package security prepare
what is supply chain security
zero day dependency response
zero day scanner
zero day vulnerability detector

Questions developers ask63 searches

Plain-language questions this page answers — in the FAQ below, the CVSS table above, and ultimately by scanning your actual manifest.

are my dependencies secure
does this package have known vulnerabilities
how bad is this vulnerability
how did this vulnerability get here
how do developers check for vulnerable packages
how do i find out if my dependencies have vulnerabilities
how to audit dependencies
how to automate vulnerability scanning
how to check for vulnerabilities
how to check if a specific package version has cve
how to check if package is vulnerable
how to check one package for known security issues
how to do a quick security audit of my dependencies
how to do dependency audit
how to find cve in project
how to find patched version for vulnerable dependency
how to find vulnerabilities in code
how to fix cve in dependencies
how to fix vulnerable dependencies
how to identify known vulnerabilities
how to know if dependency has cve
how to patch security vulnerabilities
how to patch vulnerable packages
how to read security advisories
how to remediate cve findings
how to run vulnerability scan
how to scan dependencies guide
how to scan for vulnerabilities
how to scan multiple lockfiles at once for vulnerabilities
how to update dependencies to fix security issues
how to update insecure libraries
how to update vulnerable packages
how to upgrade vulnerable dependencies
how to use vulnerability scanner
is it safe to use this package
is my project vulnerable
is this dependency version affected
is this library version safe
is this module version secure
is this package safe to use
is this package version vulnerable
is this version vulnerable
should i scan dev dependencies for cve
should i worry about this cve
what is cve rating
what is dependency vulnerability
what is sca in security
what is software composition analysis
what is the fixed version for this cve
what should i do about this advisory
what version patches cve
when was this cve disclosed
which dependencies are vulnerable
which package introduced this cve
which packages have cve
which version fixes the vulnerability
which version upgrades fix security vulnerabilities
which vulnerabilities should i fix first in my project
who approved this vulnerable package
who reported this vulnerability
why is dependency scanning important
why is this package vulnerable
why scan for vulnerabilities

By team, role & industry152 searches

From solo maintainers to bank security teams: the scan is the same battle-tested OSV.dev lookup whether you are a student, a startup founder, a CISO or an incident-response crew.

asap dependency vulnerability check
automated package auditor
best free tool for dependency audit
best tool for vulnerability scanning
best way to check for vulnerabilities
check build for advisories
check component for issues
check library for warnings
check lock file for advisories
check manifest for alerts
check module for cve
compatible version finder for security
cve alert system for dependencies
dependency audit for consultant
dependency check for fintech
dependency check for government
dependency check for open source maintainer
dependency check for real estate
dependency check for security researcher
dependency check for sre
dependency check for tech lead
dependency conflict resolver for cve
dependency scanner for agencies
dependency scanner for beginners
dependency scanner for ecommerce
dependency scanner for enterprise
dependency scanner for experts
dependency scanner for government agency
dependency scanner for insurance
dependency scanner for large enterprise
dependency scanner for manufacturing
dependency scanner for open source
dependency scanner for release manager
dependency scanner for security engineer
dependency scanner for small business
dependency scanner for startups
dependency scanner for teams
dependency security for beginners
emergency dependency audit
emergency vulnerability response
enterprise grade cve monitor
enterprise grade dependency scanner
enterprise grade security scanner
enterprise grade vulnerability scanner
enterprise usage security validation
enterprise vulnerability scanner
fire drill security scan
hotfix vulnerability scanner
hunt for advisories in lock files
hunt for alerts in manifests
hunt for cve in dependencies
hunt for vulnerabilities in packages
immediate security scan required
incident response dependency scanner
incident response vulnerability scan
inspect my lockfile for problems
intelligent package auditor
intermediary package security mediator
look up advisory for lock file
look up alert for manifest
look up cve for dependency
look up security flaw for library
look up vulnerability for package
maintainer succession security plan
mediation dependency security reconcile
middle dependency security intermediate
minimal upgrade path for cve
one tool for all ecosystems
package auditor for developer
package auditor for education
package auditor for fintech
package auditor for logistics
package auditor for mid size company
package auditor for qa engineer
package auditor for telecom
package scanner for bootcamp grad
package scanner for pentester
panic button vulnerability scanner
patched version finder for cve
post breach dependency assessment
post incident vulnerability scan
post mortem dependency security
priority order for fixing vulnerable dependencies
proactive package auditor
quick scan professional mode auditor mode
real time package auditor
remediation dependency security fix
root cause package for cve
safe version updater for dependencies
safest upgrade for cve
scan app for known cve
scan code for vulnerabilities
scan component for warnings
scan dependency tree for issues
scan library for advisories
scan module for alerts
scan my code for vulnerabilities
scan my dependencies for cve
scan my lockfile for problems
scan my packages for known issues
scan my project for security issues
scan project for security issues
search for advisories in dependency tree
search for alerts in package list
search for cve in codebase
search for cve in manifest
search for warnings in lock file
security alert dashboard for packages
security changelog viewer for packages
security flaw search for dependencies
security posture trend for dependencies
security scanner for architect
security scanner for bug bounty
security scanner for e-commerce
security scanner for managed service provider
security scanner for non profit
security scanner for qa teams
security scanner for retail
security scanner for security teams
security scanner for software engineers
security scanner for startup
security scanner for startup founder
security scanner for web developers
single scanner for all packages
smart package auditor
step by step cve remediation
test my dependencies for vulnerabilities
test my packages for security issues
upgrade recommendation for security
urgent vulnerability scan
vulnerability remediation guide
vulnerability scanner for agencies
vulnerability scanner for bank
vulnerability scanner for beginners
vulnerability scanner for ciso
vulnerability scanner for developers
vulnerability scanner for enterprise
vulnerability scanner for experts
vulnerability scanner for freelancers
vulnerability scanner for healthcare
vulnerability scanner for small team
vulnerability scanner for startups
vulnerability scanner for students
vulnerability scanner for team lead
vulnerability scanner for teams
vulnerability scanner with remediation
vulnerability scanner with remediation guide
vulnerability search engine for software
vulnerability tool for appsec
vulnerability tool for healthcare org
vulnerability tool for media company
vulnerability tool for student

Scanner features & modes125 searches

Feature-by-feature searches: three scan depths (Quick / Professional / Auditor), auto format detection, single-package checks, batch scanning, JSON export, local history, fix-version lookup and CVSS vectors.

8 ecosystems vulnerability scanner
accurate vulnerability scanner
advanced vulnerability scanner
all in one dependency scanner
all in one vulnerability scanner
auto detect ecosystem scanner
auto detect ecosystem vulnerability scanner
automated dependency checker
automated dependency scanner
automated security decision engine
automated security scanner
automated vulnerability scanner
automatic patch suggestion tool
batch and single package scanner
best free vulnerability scanner
best vulnerability scanner
best way to scan dependencies
bestness dependency security supreme
cheapest vulnerability scanner
cli vulnerability scanner
comprehensive vulnerability scanner
cve findings report creator
dependency audit free
dependency scanner free
dependency vulnerability scanner free online
download security scan report
easy vulnerability scanner
fast vulnerability scanner
fastest way to scan dependencies
free code vulnerability scanner
free dependency scanner
free dependency vulnerability scanner
free library vulnerability scanner
free online dependency check
free package scanner
free security scanner online
free vulnerability scanner
ide vulnerability scanner
instant dependency security check
instant online security scan
instant vulnerability scanner
intelligent dependency checker
intelligent dependency scanner
intelligent security scanner
intelligent vulnerability scanner
lightweight vulnerability scanner
multi ecosystem security scanner
multi language vulnerability scanner
multi language vulnerability scanner online
multi lockfile scanner
multi source dependency strategy
one module security scanner
one package vulnerability scanner
optimality package security best
package audit free
polyglot dependency security scanner
popular vulnerability scanner
proactive cve hunter
proactive dependency checker
proactive dependency scanner
proactive security scanner
proactive vulnerability scanner
quick scan vulnerability tool
quick vulnerability scanner
rapid vulnerability scanner
real time dependency checker
real time dependency scanner
real time security scanner
real time vulnerability scanner
report dependency security finding
sca scanner free
security audit report online
security scanner free
simple vulnerability scanner
single dependency advisory check
single module security scan
single package and lockfile scanner
single package vulnerability check
single package vulnerability lookup tool
single point of failure security scan
smart dependency checker
smart dependency scanner
smart security scanner
smart vulnerability scanner
software composition analysis free
supports all languages dependency scanner
three mode vulnerability scanner
top free security scanner
top vulnerability scanner
universal dependency scanner
universal dependency scanner that supports all languages
universal lockfile scanner
universal manifest scanner
vscode vulnerability scanner extension
vulnerability notification service free
vulnerability scan report generator
vulnerability scanner free
vulnerability scanner with advisory links
vulnerability scanner with api access
vulnerability scanner with auto detect
vulnerability scanner with baseline
vulnerability scanner with cli
vulnerability scanner with cve details
vulnerability scanner with dashboard
vulnerability scanner with deep scan
vulnerability scanner with dependency graph
vulnerability scanner with diff
vulnerability scanner with fix version
vulnerability scanner with history
vulnerability scanner with ide support
vulnerability scanner with jira integration
vulnerability scanner with license check
vulnerability scanner with malware detection
vulnerability scanner with multi ecosystem
vulnerability scanner with multi language
vulnerability scanner with patch suggestion
vulnerability scanner with pdf report
vulnerability scanner with quick scan
vulnerability scanner with report
vulnerability scanner with single package check
vulnerability scanner with slack alerts
vulnerability scanner with version upgrade
vulnerability scanner with vscode integration
vulnerability scanning best practices
zone dependency security sector

Scan, audit & protect — every phrasing294 searches

However you phrase it — scan, audit, check, protect, harden, hunt, triage, remediate — the workflow is the same: paste a manifest, get a CVSS-graded triage board and the exact versions that fix each finding.

3rd party vulnerability scanner
ad hoc security check
all hands dependency audit
analyze my dependency vulnerabilities
analyze my package security
api vulnerability scanner
application vulnerability scanner
assess my lockfile security
audit my build
audit my code
audit my dependencies
audit my lockfile
audit my manifest
audit my packages
audit my project
auditability package security inspect
authentication package security verify identity
auto fix vulnerable dependencies
blame the dependency scanner
breach assessment dependency check
bus factor security check
business impact vulnerability assessment
check if dependency is secure
check if library has cve
check if module is safe
check if package is vulnerable
check my code security
check my dependencies health
check my lockfile validity
check my manifest accuracy
check my project safety
code review vulnerability check
code vulnerability scanner
command line vulnerability scanner
component security scanner
component vulnerability scanner
critical vulnerability scanner
defend my component from warnings
defend my import from cve
defend my library from advisories
defend my module from alerts
dependency audit
dependency audit in dev environment
dependency audit online
dependency audit scanner
dependency audit tool
dependency audit training
dependency diversification security check
dependency fix recommendation tool
dependency graph security scan
dependency health check
dependency health monitor
dependency path to vulnerability finder
dependency redundancy security check
dependency review tool
dependency scanner
dependency scanner 2024
dependency scanner 2025
dependency scanner online
dependency scanner security
dependency scanner tool
dependency scanner vulnerabilities
dependency security audit
dependency security check
dependency security scanner
dependency tree audit
dependency update safety scan
dependency update security impact
dependency upgrade planner
dependency vulnerability audit
dependency vulnerability checker
dependency vulnerability finder
dependency vulnerability scanner
detect advisories in code
detect advisories in component
detect advisories in my stack
detect alerts in import
detect alerts in project
detect cve in my imports
detect cve in package
detect cve in software
detect issues in lock file
detect problems in my dependencies
detect warnings in app
detect warnings in dependency
detection package security find
disclosure package security reveal
discover advisories in my releases
discover issues in my stack
discovery dependency security uncover
end of life package scanner
fallback package availability scanner
find advisories in build
find advisories in lock file
find advisories in my project
find alerts in manifest
find cve in module
find cve in my code
find issues in component
find issues in my dependencies
find warnings in library
finding package security issue
fix available vulnerability check
flag advisories in my updates
flag cve in my versions
flag issues in my codebase
fork readiness security assessment
fortify my component against warnings
fortify my import against cve
fortify my library against advisories
fortify my module against alerts
full stack application dependency scanner
gauge my lockfile vulnerability
google open source security scanner
governance model security assessment
guard my code against vulnerabilities
guard my project against cve
harden my code against vulnerabilities
harden my project against cve
identify advisories in my ecosystem
identify cve in my imports
identify issues in my deps
import security checker
indirect dependency audit
individual module security check
individual package vulnerability check
learn dependency security scanning
legacy project security audit
library audit
library audit tool
library security audit
library security checker
library security review
library vulnerability audit
library vulnerability scanner
live site vulnerability check
lock file security scanner
lockfile audit
lockfile audit tool
lockfile scanner
lockfile security check online
lockfile vulnerability scanner
long term viability package check
lookup dependency advisory
lookup library cve
lookup module security issue
lookup package vulnerability
manifest audit
manifest scanner
manifest security check
manifest security checker
manifest vulnerability scanner
measure my dependency security
microservices dependency security scanner
migration path availability checker
migration security check
minimal change security fix
module vulnerability lookup
module vulnerability scanner
monitorability dependency security observe
name at version vulnerability checker
nested dependency audit
non breaking security update
non breaking security update tool
old codebase vulnerability scan
online vulnerability scanner
open source audit
open source dependency scanner
open source scanner
open source security audit
open source security scanner
open source vulnerabilities database scanner
open source vulnerabilities scanner
open source vulnerability scanner
open source vulnerability scanner tool
orphaned package security scanner
oss scanner
package audit
package audit online
package audit scanner
package audit tool
package name version vulnerability lookup
package scanner
package scanner 2024
package scanner 2025
package security audit
package security review
package security scanner
package sustainability scanner
package vulnerability audit
package vulnerability scanner
patch currency assessment tool
peer dependency aware security fix
prevent advisories in my library
prevent alerts in my module
prevent cve in my import
prevent cve in my project
prevent shipping vulnerable code
prevent vulnerabilities in my code
prevent warnings in my component
project vulnerability scanner
protect my code from vulnerabilities
protect my component from warnings
protect my import from cve
protect my library from advisories
protect my module from alerts
protect my project from cve
release blocking vulnerability check
release pattern stability check
reveal advisories in my ecosystem
reveal cve in my stack
reveal issues in my project
review my dependency security
review my lockfile validity
review my package vulnerabilities
runtime vulnerability scanner
safeguard my code from vulnerabilities
safeguard my project from cve
sca scanner
sca security scanner
secure coding dependency practices
secure my code from vulnerabilities
secure my component from warnings
secure my import from cve
secure my library from advisories
secure my module from alerts
secure my project from cve
secure vulnerability scanner
security check in qa environment
security lag time measurement
security patch availability checker
security scanner
security scanner 2024
security scanner 2025
security scanner online
security scanner tool
security scanning workshop
security vulnerability scanner
self hosted vulnerability scanner
semver compliant security fix
semver safe vulnerability fix
sensing dependency security detect
shield my component from warnings
shield my import from cve
shield my library from advisories
shield my module from alerts
software composition analysis scanner
software security maturity measurement
software vulnerability scanner
sub dependency security check
system dependency security check
test coverage security correlation
testability dependency security verify
third party audit
third party security audit
third party vendor security check
third party vulnerability scanner
tool to look up vulnerabilities by package name and version
transitive dependency audit
transitive dependency scanner
transitive dependency vulnerability scanner
uncover advisories in my libraries
uncover cve in my dependencies
uncover issues in my software
uncovery package security reveal
unmaintained package detector
unused dependency security scan
upgrade cadence security impact
upgrade effort estimation security
upgrade path vulnerability scanner
upgrade vulnerability assessment
validate my dependency security
validate my lockfile accuracy
vendor lock in security assessment
vendor open source security audit tool
verify my code security
verify my dependency health
verify my package status
verify my project safety
version bump security check
version strategy security assessment
vulnerability fix version lookup
vulnerability scanner
vulnerability scanner 2024
vulnerability scanner 2025
vulnerability scanner online
vulnerability scanner online tool
vulnerability scanner open source
vulnerability scanner that does not upload code
vulnerability scanner tool
vulnerability scanner web tool
web app vulnerability scanner
web application dependency scanner
workspace aware vulnerability fix

Dependency security concepts & glossary255 searches

The long tail of dependency-security vocabulary — from transitive risk and bus factor to maintainer succession and package sustainability. Each concept feeds the same practical question this tool answers: is this dependency tree safe to ship?

absoluteness dependency security complete
abundance package security plenty
acceleration package security increase
acceptance package security decision
access dependency security entry point
accessibility dependency security available
accountability package security responsible
actions on objectives package security
adequacy package security suitable
adoption rate security signal
aggregation package security collection
answer dependency security response
antifragility dependency security growth
api dependency vulnerability
appropriateness package security fitting
area dependency security region
artifact dependency security deliverable
assembly dependency security construction
assertion dependency security claim
authority package security power
authorization dependency security control
authorization dependency security permission
availability package security present
awareness package security conscious
backend dependency vulnerability
backward compatibility security guarantee
balance package security equilibrium
being dependency security essence
boundlessness dependency security unlimited
breach dependency security violation
breach package security gap
break package security rupture
breaking change frequency security
build tool vulnerability
building dependency security edifice
capability package security skill
capacity dependency security capability
categorization dependency security group
center package security middle
chance package security luck
chip package security crack
classification package security categorize
closure package security resolution
code quality security interaction
collection dependency security gathering
compatibility package security work
compensation dependency security control
completeness package security entire
completeness package security perfect
complexity dependency security intricacy
complexity vulnerability relationship
composability dependency security combine
comprehension package security grasp
conclusion dependency security end
condition package security status
configurability package security adjust
consciousness dependency security aware
constancy package security reliable
construction package security building
control effectiveness package security
control gap dependency security
core dependency security center
crack dependency security fissure
critical path vulnerability analysis
crown jewel dependency identifier
customizability dependency security tailor
cve arrival rate tracker
de facto standard security implications
debuggability package security diagnose
deficiency package security weakness
delivery dependency security transmit
dependency analysis tool
dependency graph visualization security
dependency graph vulnerability
dependency security analysis
dependency security trends
dependency security tutorial
dependency tree security analysis
dependency vulnerability tool
deprecated package vulnerability
deprecated standard migration security
destruction dependency security elimination
deviation package security variance
document package security output
documentation security maturity link
door dependency security opening
duration dependency security length
edifice package security structure
elasticity dependency security stretch
elegance dependency security refinement
elevation dependency security privilege
emerging standard security readiness
ending package security termination
endurance package security last
enough dependency security adequate
entirety dependency security total
entropy dependency security disorder
entry package security access
equilibrium dependency security stability
essence package security core
eternity dependency security infinite
event dependency security occurrence
evidence package security record
exception dependency security waiver
existence package security being
extensibility package security add
extent package security reach
feedback package security input
finality package security conclusion
fissure package security fracture
fitness dependency security readiness
flexibility dependency security agility
fortune package security wealth
fracture dependency security break
fragility dependency security weakness
fragment dependency security shard
framework package security scaffold
frequency dependency security rate
funding stability security indicator
gap dependency security hole
gathering package security assembly
government usage security endorsement
harmony dependency security balance
holding dependency security maintain
hole package security opening vulnerability
idealness dependency security optimal
identification dependency security recognize
impact package security consequence
incident package security disruption
industry standard package security
inertia package security resistance
infinity package security boundless
input dependency security entry
insight dependency security perceive
installation package security establish
intent package security purpose
interoperability dependency security connect
interoperability security validation
key person dependency security
knowledge package security know
lasting dependency security permanent
limitlessness package security absolute
location dependency security place
lockfile security validator
luck dependency security fortune
maintainability dependency security upkeep
maintenance package security sustain
mitigation package security reduction
modularity package security component
momentum dependency security inertia
motivation dependency security driver
new project security setup
new transitive dependency alert
observation dependency security note
open source security 2024
open source security 2025
open source security fundamentals
open source vulnerability tool
opening package security window
openness package security accessible
operability dependency security run
ordering package security sequence
outage caused by vulnerable dependency
outlook package security prospect
package abandonment contingency plan
package reliability security index
part dependency security piece
perception package security sense
perfection package security ideal
permanence package security eternal
persistence package security maintain
perspective dependency security outlook
piece package security fragment
place package security space
placement package security location
planning dependency security prepare
plenty dependency security sufficient
portability package security transfer
portal package security door
portion package security part
position dependency security placement
preparation package security ready
preparedness package security readiness state
presence dependency security exist
procedure dependency security implementation
prospect dependency security possibility
ranking dependency security order
reachable vulnerability analysis tool
readiness dependency security prepared
recommendation package security action
reconciliation package security harmonize
region package security zone
reliability dependency security dependable
resilience package security recovery
resolution dependency security solution
responsibility dependency security duty
revelation dependency security disclose
robustness package security strength
room package security area
root cause vulnerable package
rupture dependency security breach
scaffolding dependency security support
scheduling package security plan
scope dependency security boundary
sector package security segment
security debt quantification tool
segment dependency security portion
sequencing dependency security arrange
shard package security splinter
simplicity package security clarity
software composition analysis tool
solution package security answer
space dependency security room
specific dependency version advisory
specific module version security
specific package version vulnerability
splinter dependency security chip
stability package security steady
standing package security position
state dependency security condition
status dependency security standing
steadiness dependency security constant
structure dependency security framework
substitutability dependency security replace
sufficiency package security enough
suitability dependency security appropriate
support package security hold
supportability package security assist
supremacy package security ultimate
sustainability dependency security endure
target package security objective
technical debt security correlation
technical security debt calculator
technology roadmap alignment security
termination dependency security closure
throughput package security capacity
totality package security sum
traceability dependency security follow
transitive dependency tree viewer
transparency dependency security open
ultimacy dependency security final
understanding dependency security comprehend
validation dependency security confirmation
velocity dependency security speed
verification package security proof
view package security perspective
vulnerability disclosure timeline viewer
vulnerability management guide
vulnerability management maturity
vulnerability opening dependency security entry
vulnerability trend analysis tool
weakness dependency security flaw
wealth dependency security abundance
wholeness dependency security completeness
window dependency security view

One scanner for npm, PyPI, Maven, Go, crates.io, RubyGems, Packagist and NuGet — package.json, package-lock.json, yarn.lock, requirements.txt, pom.xml, go.mod, Cargo.lock, Gemfile.lock, composer.lock and .csproj, auto-detected and parsed entirely in your browser. Free, no signup, no install, no code upload.

Package Vulnerability Scanner

Dependency scanner console

What one unpatched CVE actually costs

Check a single package version

CVSS v3.1 score → severity rating

The math behind the grades

CVSS v3.1 base score (FIRST.org)

This page's exposure score

Supported ecosystems & advisory sources

Your recent scans

How to scan your dependencies in 5 steps

Paste or drop your manifest

Choose your depth

Run the scan

Read the risk gauge and triage board

Apply the fix plan and re-scan

Why dependency scanning became non-negotiable

Vulnerability Scanning FAQs

Trusted by DevSecOps, Platform & Audit Teams

Related tools

Related Articles

Every dependency-security search this scanner answers