SBOM Checker and Component CVE Lookup

A Software Bill of Materials (SBOM) vulnerability scanner inventories all components in a product. It covers open-source libraries, transitive dependencies, third-party SDKs, and firmware modules. It matches these components against known vulnerability feeds. CRA Annex I requires manufacturers to identify and document software components. Using dedicated SBOM tooling and regular vulnerability scans makes it fast to assess exposure whenever new CVEs are published.

Yes. This SBOM component checker is part of CVD Portal's suite of free SBOM tools. It runs entirely in your browser with no registration or credit card required. You can paste component lists from npm, pip, Maven, Go modules, or Docker image manifests for rapid triage.

This tool accepts free-form component lists generated by popular SBOM generation tools: package@version (npm, pip, Go modules), groupId:artifactId:version (Maven), and plain component names. For full SBOM document validation, use SPDX or CycloneDX format validators. This tool is designed for rapid manual triage, not full SBOM ingestion.

The two dominant SBOM formats are SPDX (ISO/IEC 5962) and CycloneDX. Both are accepted by most tooling and procurement frameworks. CycloneDX is often preferred for security use cases as it natively supports vulnerability data (VEX). SPDX is more widely supported for license compliance and open source license information. Consider generating both.

This tool generates NVD search links for each component. The tool does not query the NVD API directly. Click any component link to open the NVD search results in a new tab. CVD Portal's full SBOM monitoring feature integrates directly with the NVD API to alert you when new CVEs are published for components in your registered SBOMs.

CPE (Common Platform Enumeration) is the standard identifier format used by the NVD. A CPE looks like: cpe:2.3:a:vendor:product:version:*:*:*:*:*:*:*. Many package managers have CPE dictionaries. The NVD also provides a CPE search tool. Mapping your SBOM file to CPEs enables precise automated vulnerability matching across your software supply chain.

The Yocto Project ships a cve-check class that reports CVEs against recipe versions during a build. Yocto can also emit an SPDX document for the built image. Pasting a component list into this tool provides the faster route for a one-off triage. The native Yocto output provides the better route for a build that runs repeatedly.

A kernel entry in an SBOM names one version. A plain version match returns a large list of CVEs. Most kernel CVEs affect a subsystem that the product never enables. The applicable question is which kernel configuration ships on the device. A VEX document is where a manufacturer records that a listed CVE does not apply.

An SBOM checker asks which components carry known CVEs. An SBOM validator asks whether an SBOM document is well formed against SPDX or CycloneDX specifications.

No, an SBOM CVE check does not prove CRA compliance on its own. The check helps you identify vulnerable components that require remediation. Annex I Part II(1) requires a software bill of materials in a commonly used machine-readable format covering at least the top-level dependencies. The vulnerability handling duties in Annex I Part II apply from 11 December 2027. Conformity also needs the technical documentation, and a default-class product reaches it through self-assessment under Module A.

Matching runs in three steps named extraction, matching and verification. An SBOM security checker performs those three steps in order. During extraction, the tool reads a component list and takes the name and version from each line. During matching, it builds one NVD search per component so a known CVE for that name and version surfaces. During verification, you check each returned CVE against the configuration the product ships. A component can be present while the affected code path is unreachable. A VEX document is where a manufacturer records that a listed CVE does not apply.

CVD Portal provides three free tools for SBOM workflows. This checker matches components against known CVEs. The SBOM validator checks whether an SBOM document is well formed. The SBOM exposure snapshot reports which products a component reaches. All three tools run without an account.