vulnwire

Check your stack

Give vulnwire a lockfile and it lists the vulnerabilities affecting exactly the versions you have pinned, KEV and EPSS first. You get a report page and an RSS feed that picks up new advisories for the same packages.


Up to 5 MB.

…or paste its contents

No file? Use a URL

List packages as ecosystem:name@version, comma-separated, and you get an RSS feed directly. Nothing is stored:

https://vulnwire.hypernurb.dev/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0

Add &format=atom or &format=json for other formats. From scripts, POST to/api/v1/stack; see the API docs. Matching uses OSV's exact-version semantics for each ecosystem. No matches means none were found, not that the packages are safe.