Step 4 of 5 in Have I got the day-1 policies?
Research: referenced in the ENISA SME CRA Survey 2026.
Upload a Software Bill of Materials in SPDX 2.x or CycloneDX 1.x JSON format and we'll check every component against the OSV.dev open-source vulnerability database — the same engine our paid scanner uses. No signup, no email, and your file is scanned in memory and never stored.
Drop your SBOM file here
SPDX or CycloneDX · .json up to 2 MB
Privacy: files are parsed in memory to query OSV.dev and are never stored. The free scanner is rate-limited per visitor.
Your vulnerability report will appear here
Upload an SPDX 2.x or CycloneDX 1.x JSON SBOM and click "Scan for vulnerabilities" to see known CVEs across your components, ranked by severity.