Free tool
SBOM viewer and checker
Open a software bill of materials in CycloneDX or SPDX (JSON): see its components, and what the Cyber Resilience Act and good vulnerability matching expect that is missing.
Runs entirely in your browser: nothing you type or open is sent to us or stored.
Summary
- Format
- Product
- Produced
- Tool
- Components
| Component | Version | Package URL | Supplier | Licence |
|---|
What the CRA asks of an SBOM
From 11 December 2027, Annex I, Part II of the Cyber Resilience Act asks manufacturers to draw up a software bill of materials "in a commonly used and machine-readable format covering at the very least the top-level dependencies of the products". It belongs to the technical documentation; it does not have to be published.
An SBOM is only useful if it is current: generate it at every release, keep each release’s copy, and match it against vulnerability data every day. Provetry does all three for every product.
Other free tools
- security.txt generator and checker
Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.
- CVSS 3.1 calculator
Score a vulnerability from its eight base metrics, or paste a vector to read it.
- CVSS 4.0 calculator
The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.
- EPSS score lookup
How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.
- Vulnerability disclosure policy generator
A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.
- SBOM generator
Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.