Vulnerability Checker: CVE, CISA KEV & EPSS for SBOMs

No warranty, not security advice; no known exploited CVEs found does not mean secure.

This vulnerability checker takes your software inventory or SBOM and tells you, per component, which known CVEs affect that exact version, which of them are being exploited in the wild (CISA Known Exploited Vulnerabilities catalog), the EPSS exploit probability, the CVSS score, the version that fixes them and a clear priority bucket.

It is a lookup, not a scanner: it never touches your hosts or networks. You give it names, versions, package URLs, CPEs, a CycloneDX or SPDX SBOM, or CVE IDs, and it checks them against public vulnerability databases.

What it does

• Reads any inventory format: product names with versions (Progress MOVEit Transfer 2023.0.0), package URLs (pkg:npm/lodash@4.17.20), CPE names (cpe:2.3:a:apache:log4j:2.14.1), CycloneDX JSON or SPDX JSON SBOMs, a structured component list, or plain CVE IDs.
• Finds the CVEs for that version: open-source packages through OSV.dev, products through the NVD, using the version ranges published there. Every CVE says how it was matched (version_range, exact_version, all_versions_listed).
• Flags exploited vulnerabilities: CISA KEV status with the date added, the remediation due date, known ransomware use and the required action.
• Adds the EPSS score: the probability of exploitation activity in the next 30 days, with its percentile.
• Tells you what to upgrade to: the fixed version per CVE and the lowest version that fixes all of them.
• Sorts by priority with fixed, documented rules (see below), so you can work the list from the top.
• Matches messy product names: when a name like Log4j2 or MS Exchange does not match the NVD product dictionary exactly, an AI match score picks the right NVD product (CPE) and tells you how sure it is. For this step the vendor, product name and version from your input are sent to an external AI service for this fixed comparison only. Turn off AI product match for free-text names to keep it off.

Who uses it

• MSPs and IT teams checking a client asset list against the CISA KEV catalog.
• Compliance teams preparing for NIS2, DORA, the EU Cyber Resilience Act, SOC 2 or ISO 27001, who need a dated, sourced vulnerability list per product.
• Procurement and vendor risk teams answering "does this supplier's software have exploited vulnerabilities?"
• Developers and DevSecOps checking an SBOM from their build before a release.
• AI agents doing vendor reviews or security questionnaires through the API.

Output

One row per component (or per CVE ID you looked up).

Field	What it means
status	vulnerable, no_known_vulnerabilities, version_missing, found (CVE lookups), not_found, product_not_identified, incomplete_licence_restricted, needs_distro_version, unknown_distro_release, not_covered, invalid_input or source_unavailable (see Statuses below)
withheldAdvisoryCount	Package URLs only: OSV.dev records left out because their licence does not allow commercial reuse
priority	act_now, high, medium, low or none
priorityReason	Why the top vulnerability got that priority
component, vendor, version	What was checked
cveCount	Known vulnerabilities affecting this version
exploitedCount, exploitedCves	How many and which are in the CISA KEV catalog
earliestKevDueDate	Earliest CISA remediation due date
ransomwareCount	KEV entries with known ransomware use
maxCvss, maxEpss	Highest CVSS base score and EPSS probability
upgradeTo	Lowest version that fixes every vulnerability with a known fix
noFixCount	Vulnerabilities without a published fixed version
vulnerabilities	Per CVE: CVSS score, severity and vector, CWE, KEV fields, EPSS and percentile, fixed version, affected range, match basis, vendor advisory and patch links, NVD and OSV links, source, licence, licence URL (licenceUrl) and textNote (texts are truncated; for some sources only the ID and link are given)
affectedProducts	For CVE lookups: affected products with version ranges and fixed versions
productMatch	How the product was identified: package URL, CPE, exact name or AI match with a probability and the alternatives
purl, cpe, ecosystem	The identifiers used for the lookup
summary	One sentence for your report
sources	Sources and licences for this row, with the NVD and CISA notices
disclaimer	No warranty, not security advice; no known exploited CVEs found does not mean secure

Statuses

Status	Meaning	Charged
vulnerable	Known vulnerabilities affect this version	Yes
no_known_vulnerabilities	The sources checked list none for this version	Yes
version_missing	No version given; only exploited (KEV) vulnerabilities and malicious-package records for the product are listed	Yes
found	CVE ID looked up	Yes
incomplete_licence_restricted	Every OSV.dev record for this package comes from a source whose licence does not allow commercial reuse (Chainguard / Wolfi), so the package could not be checked. withheldAdvisoryCount says how many records were withheld. Never reported as clean	No
needs_distro_version	An OS package URL without a usable distribution release got no records. Add ?distro= (for example ?distro=debian-12, ?distro=ubuntu-22.04, ?distro=alpine-3.20, ?distro=almalinux-9 or ?distro=rocky-9) and run it again. Never reported as clean	No
unknown_distro_release	The release in ?distro= (for example alpine-3.99) is not known to OSV.dev, so the package could not be checked. Never reported as clean	No
not_covered	An OS package from a distribution without release-specific lookup here (for example Red Hat, CentOS, Fedora or SUSE rpm packages) got no records from its package URL. Never reported as clean	No
not_found, product_not_identified, invalid_input, source_unavailable	Unknown CVE ID or product, unreadable entry, or a source did not answer	No

If some OSV.dev records for a package are withheld for licence reasons but others remain, the row lists the remaining ones, sets withheldAdvisoryCount and says in note that the list may be incomplete.

Distribution releases: ?distro= is used for Debian and Ubuntu (deb), Alpine (apk) and AlmaLinux and Rocky Linux (rpm). Before a package with a release is reported clean, the Actor checks that OSV.dev has data for that release. For other rpm distributions (Red Hat, CentOS, Fedora, SUSE) ?distro= is not used: the package URL is looked up as given, results may cover several releases and the row says so in note. A distribution advisory (for example a Debian DSA) that covers several CVEs is listed once per CVE, each with its own CISA KEV and EPSS check.

The run summary (key-value store record SUMMARY) has counts per status and priority, the list of components to act on now, the KEV catalog version and the EPSS score date.

Priority rules

The priority is set by code, not by AI, so you can explain it to an auditor:

Bucket	Rule
act_now	Listed in the CISA KEV catalog, or reported as a malicious package
high	CVSS 9.0 or higher, or EPSS 10% or higher
medium	CVSS 7.0 or higher, or EPSS 1% or higher
low	Everything else
none	No known vulnerabilities in the sources checked

The component gets the highest bucket of its vulnerabilities.

How to run

1. Paste your items into Software inventory, one per line. Mix formats as you like.
2. Or paste an SBOM into SBOM, or give a link to it in SBOM file URL.
3. Or put CVE IDs from a scanner report or questionnaire into CVE IDs.
4. Start the run and open the Components view, or download as Excel, CSV or JSON.

Tips:

• Always give a version. Without one, you get only the exploited (KEV) vulnerabilities known for the product, which is still useful for a vendor review.
• Package URLs are the most precise input. Most SBOM tools write them for every package.
• Product names, CPEs and CVE IDs are looked up in the NVD, which allows 5 requests per 30 seconds without a key. We strongly recommend adding your own free NVD API key in NVD API key: it makes those lookups about 9 times faster and keeps your lookups within the NVD's published rate limits. Package URLs do not need it.
• Results are cached for a day, so a rerun of the same list is fast.

Input example

{
  "inventory": [
    "Progress MOVEit Transfer 2023.0.0",
    "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
    "pkg:npm/lodash@4.17.20",
    "cpe:2.3:a:apache:http_server:2.4.49",
    "CVE-2021-44228"
  ],
  "components": [
    {"reference": "srv-12", "vendor": "Fortinet", "product": "FortiOS", "version": "7.2.3"}
  ]
}

Example output

{
  "input": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1",
  "inputType": "purl",
  "status": "vulnerable",
  "priority": "act_now",
  "priorityReason": "Listed in the CISA Known Exploited Vulnerabilities catalog, known ransomware use",
  "component": "org.apache.logging.log4j:log4j-core",
  "version": "2.14.1",
  "cveCount": 8,
  "exploitedCount": 2,
  "exploitedCves": ["CVE-2021-44228", "CVE-2021-45046"],
  "earliestKevDueDate": "2021-12-24",
  "ransomwareCount": 2,
  "maxCvss": 10.0,
  "upgradeTo": "2.25.4",
  "vulnerabilities": [
    {
      "cveId": "CVE-2021-44228",
      "otherIds": ["GHSA-jfh8-c2jp-5v3q"],
      "cvssScore": 10.0,
      "cvssSeverity": "CRITICAL",
      "cwes": ["CWE-20", "CWE-400", "CWE-502", "CWE-917"],
      "inKev": true,
      "kevDateAdded": "2021-12-10",
      "kevDueDate": "2021-12-24",
      "kevRansomwareUse": "Known",
      "epss": 0.99999,
      "epssPercentile": 1.0,
      "fixedIn": "2.15.0",
      "matchBasis": "version_range",
      "priority": "act_now",
      "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "source": "GitHub Advisory Database via OSV.dev",
      "licence": "CC BY 4.0",
      "licenceUrl": "https://creativecommons.org/licenses/by/4.0/",
      "textNote": "Title truncated to 200 characters."
    }
  ],
  "summary": "org.apache.logging.log4j:log4j-core 2.14.1: 8 known vulnerabilities, 2 exploited in the wild (CISA KEV, earliest due 2021-12-24, known ransomware use), highest CVSS 10.0. Upgrading to 2.25.4 or later fixes all of them. Priority: act now."
}

API use

Run it from your own code or an AI agent with the Apify API. Example with curl:

curl -X POST "https://api.apify.com/v2/acts/reliable_tools~vulnerability-checker/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"inventory": ["pkg:npm/lodash@4.17.20", "Progress MOVEit Transfer 2023.0.0", "CVE-2023-34362"]}'

To check an SBOM from your build pipeline, send it as "sbom": { ...your CycloneDX or SPDX JSON... } or host the file and send "sbomUrl". Fail the build when any row has "priority": "act_now".

Pricing

Pay per result, no subscription:

Event	Price
Component checked (including clean components)	$0.002
CVE ID looked up	$0.002
AI product match (only when a name needed it)	$0.002
Actor start	$0.00005 per run

Invalid entries, unknown products, unknown CVE IDs, source errors, incomplete_licence_restricted, needs_distro_version, unknown_distro_release and not_covered rows are free. A 70-component SBOM costs about $0.14.

Sources and licences

Source	Used for	Licence
CISA Known Exploited Vulnerabilities catalog	Exploited in the wild, due date, ransomware use	CC0 1.0. Use of the catalog does not imply endorsement by CISA or DHS
NIST National Vulnerability Database (CVE and CPE APIs)	CVE details, CVSS, CWE, affected version ranges, references, product dictionary	Public domain
FIRST EPSS (scores generated by Empirical Security)	Exploit probability and percentile	Free to use, attribution to FIRST EPSS
OSV.dev	Open-source package vulnerabilities and fixed versions	Per source, as listed on the OSV.dev data sources page (google.github.io/osv.dev/data); each row names its source, licence and licence URL

This product uses the NVD API but is not endorsed or certified by the NVD. This Actor is not affiliated with or endorsed by NIST, CISA, DHS, FIRST or OSV.dev.

OSV records are handled with an allow-list of record ID prefixes whose source licence is documented and allows commercial reuse (for example GitHub Advisory Database, PyPI, Go, OSS-Fuzz and Red Hat under CC BY 4.0, RustSec under CC0, Bitnami and OpenSSF Malicious Packages under Apache 2.0, AlmaLinux and Curl under MIT). For these, a title truncated to 200 characters is shown with source and licence. Records from share-alike sources (Ubuntu and Alpine, CC BY-SA 4.0), from sources without a documented licence (such as Debian) and from any prefix not on the list are given as ID and osv.dev link only, without copied text. Records from feeds whose licence does not allow commercial use or changes (Chainguard / Wolfi, CC BY-NC-ND 4.0) are left out; a package whose records all come from such a feed is returned as incomplete_licence_restricted, free of charge, and never as clean.

FAQ

If no exploited CVEs are found, is my software secure? No. The result only covers vulnerabilities published in the sources at the time of the run and the names and versions you gave. No warranty, not security advice.

Does it scan my servers? No. It only looks up the names, versions and identifiers you give it. Nothing is sent to your hosts.

What is the CISA KEV catalog? The list of vulnerabilities that the US Cybersecurity and Infrastructure Security Agency knows are exploited in the wild. US federal agencies must fix them by the due date; many companies use it as their "fix first" list.

What is EPSS? The Exploit Prediction Scoring System estimates the probability that a CVE will see exploitation activity in the next 30 days. A score of 0.1 means 10%.

Why does a product show all_versions_listed? Some NVD entries list a product without a version range. The CVE may apply to your version, but the NVD does not say which versions are affected, so check the vendor advisory.

Why is upgradeTo empty for some CVEs? The source lists the last affected version but no fixed version yet. Those are counted in noFixCount.

How reliable is the AI product match? Every match comes with a probability and the alternatives it considered. Names that match the NVD dictionary exactly skip the AI. Below 0.6 the product is reported as not identified and you are not charged; give the CPE or the vendor and product as the NVD writes them.

Which SBOM formats work? CycloneDX JSON (1.2 to 1.6) and SPDX JSON (2.2 and 2.3). Components with a package URL are checked through OSV.dev, components with a CPE or only a name and version through the NVD.

Something broke or a field is missing? Open an issue on the Issues tab and we'll look at it.

About Reliable Tools

This Actor is made by Reliable Tools. We build tools that return clean data from official sources plus an AI label with a confidence score where it helps, so you can filter and act on the results straight away. Our focus is compliance, e-commerce, product sourcing and lead research.

If a field is missing or an entry doesn't match the way you expect, open an issue on the Issues tab. We read every one and usually reply within a day. You can find our other Actors on our profile page.