Free tool
Upload an SBOM and find out how many of its components are affected by a vulnerability that's being actively exploited right now — matched against CISA KEV and ENISA's EUVD. No signup. Your SBOM is scanned in memory and never stored.
CycloneDX or SPDX JSON, up to 20 MB.
This is a one-off snapshot. Cravault monitors the SBOMs of your released versions continuously and, when something you ship starts being exploited, hands you a ready-to-file EU CRA Article 14 report — with the 24-hour clock already running.
See plans