Dependency Vulnerability Scanner: CVE, KEV, EPSS

This dependency vulnerability scanner checks package versions for known CVE vulnerabilities. You get one row per package. Each row shows the vulnerability count, the worst severity, CVE IDs, the CISA KEV flag, the highest EPSS score, the fixed version and the end-of-life status.

Use it for dependency security audits, reviews of a new codebase, vendor due diligence and scheduled alerts. AI agents can call it with a list of packages and read one clear row per package.

Dependency vulnerability sources

Source	What it adds
OSV.dev	Known vulnerabilities (GHSA, PYSEC, GO, RUSTSEC and others) with CVE aliases, severity and fixed versions
CISA KEV	Whether a CVE is known to be exploited, and whether it is used in ransomware campaigns
FIRST EPSS	Probability that a CVE is exploited in the next 30 days
endoflife.date	End-of-life and support dates for runtimes, frameworks, databases and operating systems

Ecosystems: npm, PyPI, Maven, Go, NuGet, crates.io, RubyGems, Packagist, Pub and Hex.

On 21 October 2026 the CISA KEV catalog held 1,754 CVEs and endoflife.date tracked 485 products.

Vulnerability data returned

Field	Meaning
type	package for a package version, product for an end-of-life check
ecosystem, name, version	The package version that was checked
vulnCount	Known vulnerabilities for this version. Advisories that share an alias (for example a GHSA and a PYSEC record for the same CVE) count once
worstSeverity	CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN, or NONE when nothing is known
maxCvssScore	Highest CVSS v3 base score
vulnIds, cveIds	Advisory IDs and their CVE aliases
inKev, kevCveIds, kevRansomware	CISA KEV matches
maxEpss, maxEpssPercentile, maxEpssCve	Highest EPSS score and its CVE
fixedVersion	Lowest version above yours that OSV lists as fixed for every vulnerability with a fix
unfixedVulnCount	Vulnerabilities with no fixed version above yours
vulnerabilities	One entry per vulnerability with summary, severity, CVSS, fix, KEV and EPSS. Sorted by KEV, then EPSS, then severity
latestVersion, license, deprecated, deprecationMessage	Latest version, license and deprecation flag from the npm and PyPI registries (input includePackageInfo, on by default). Empty for other ecosystems
eolProduct, eolCycle, isEol, eolDate, activeSupportEnds, isMaintained, latestInCycle, latestCycle	endoflife.date status for the version's release cycle
errors	Problems while checking the row

Empty values:

• End-of-life fields are null when endoflife.date does not track the package. It tracks about 30 npm packages and a few hundred products.
• maxEpss is null when no CVE of the package has an EPSS score.
• cvssScore is null when the advisory has only a CVSS v4 vector or no vector.
• Product rows have null vulnerability fields.

How to use the vulnerability scanner

1. Add packages, one per line, as ecosystem:name@version. For example npm:lodash@4.17.15 or PyPI:django@3.2.0. Package URLs such as pkg:npm/lodash@4.17.15 also work.
2. Or paste a package.json, package-lock.json or requirements.txt.
3. Add products for end-of-life checks, for example nodejs@18, python@3.8 or ubuntu@20.04.
4. Run the Actor. Sort by inKev and maxEpss to see what to fix first.
5. Turn on Monitor mode and schedule the Actor. You then get a row only when a package gets a new advisory, a KEV listing or an end-of-life change.

Option	Default	Meaning
Packages	Sample list	One package version per line
package.json or package-lock.json	None	From package.json, the base version of each range is checked (^4.17.1 becomes 4.17.1). Tags such as latest are skipped
requirements.txt	None	Lines pinned with == are checked. Other lines are skipped and listed in the log
Include devDependencies	On	Check dev dependencies too
Products	Sample list	endoflife.date product name and version
Check end-of-life status	On	Add endoflife.date data
Check CISA KEV	On	Add the KEV flag
Add EPSS scores	On	Add EPSS scores
Only packages at risk	Off	Save only rows with a vulnerability or an end-of-life release
Monitor mode	Off	Return a row only when its findings change
Monitor state key	default	Name of the monitor memory. Use one per project
Maximum rows	100	Stop after this many rows. Set 0 for no limit

Dependency audit pricing

The Actor uses pay-per-event pricing.

Event	Price
Actor start	$0.02 per run at the default 256 MB memory (one event per GB, minimum one)
Package checked	$0.002 per package or product row saved to the dataset

So 500 packages cost about $1 plus the start fee. Rows skipped by "Only packages at risk" or by monitor mode cost nothing. Duplicate packages in the input are checked once. The Pricing tab always shows the current price.

Input and output example

Input from a real run on 21 October 2026:

{
  "packages": ["npm:lodash@4.17.15", "npm:jquery@3.4.0", "PyPI:requests@2.25.0", "npm:minimist@1.2.5"],
  "maxItems": 3
}

The first output row from that run (lists shortened, one of six vulnerabilities shown):

{
  "type": "package",
  "ecosystem": "npm",
  "name": "lodash",
  "version": "4.17.15",
  "vulnCount": 6,
  "unfixedVulnCount": 0,
  "worstSeverity": "HIGH",
  "maxCvssScore": 8.1,
  "cveIds": ["CVE-2020-28500", "CVE-2020-8203", "CVE-2021-23337", "CVE-2025-13465"],
  "inKev": false,
  "kevRansomware": false,
  "maxEpss": 0.21333,
  "maxEpssPercentile": 0.97583,
  "maxEpssCve": "CVE-2021-23337",
  "fixedVersion": "4.18.0",
  "vulnerabilities": [
    {
      "id": "GHSA-35jh-r3h4-6jhm",
      "cveIds": ["CVE-2021-23337"],
      "summary": "Command Injection in lodash",
      "severity": "HIGH",
      "cvssScore": 7.2,
      "fixedVersion": "4.17.21",
      "inKev": false
    }
  ],
  "eolProduct": null,
  "osvUrl": "https://osv.dev/list?ecosystem=npm&q=lodash",
  "errors": []
}

Dependency vulnerability FAQ

How is this different from npm audit?

npm audit covers npm only. This Actor covers ten ecosystems in one run. It also adds the CISA KEV flag, EPSS scores and end-of-life dates.

Does it install or run my packages?

No. The Actor reads only the package names and versions you give it. It sends them to the OSV API.

What does the CISA KEV flag mean?

CISA lists CVEs that attackers already exploit. A package with inKev: true should be fixed first.

How exact are versions from package.json?

A version range is checked at its lowest version. Use package-lock.json for the exact installed versions.

Can I look up a single CVE?

The Actor works per package version. Every row lists the CVE IDs of that version with severity, KEV and EPSS data.

Can AI agents use it?

Yes. The input is a short list of ecosystem:name@version strings. The output is flat JSON with one row per package.

Data sources and use

• All four sources are free public APIs that need no login or key.
• OSV advisory data comes from many databases under their own licenses, mostly CC-BY 4.0. EPSS asks for attribution: scores come from FIRST.org EPSS. endoflife.date data is MIT licensed. CISA KEV is a US government work.

Related Actors

• Technical SEO Audit: crawl a website and find technical SEO problems.
• Regulator Circulars Monitor: track new circulars from the Central Bank of Jordan and the Saudi National Cybersecurity Authority.

Support

Report a problem in the Issues tab. Include the run link.