ARPSyndicate
SBOM Vulnerability Scanner
Upload a CycloneDX or SPDX SBOM — from Trivy, Grype, or Syft — and check every component against the same database behind Exploit Observer.
- Upload your SBOM — CycloneDX (JSON/XML) or SPDX (JSON/tag-value), any format that embeds
pkg:purls. - We extract package identifiers in your browser. The file itself is never uploaded anywhere.
- Each identifier is checked against the VEDAS vulnerability database, and results land in a table you can export as CSV.
Free & anonymous — rate-limited to 2 requests/minute per IP, so large SBOMs take a while. Add an API key for higher throughput (same data either way).
| Component▲ | Ecosystem▲ | Version▲ | Status▲ | Found▲ | Maturity▲ | Identifiers |
|---|
Works with the SBOM tools you already use
If you already generate SBOMs as part of a build or scan, this reads what they produce — no separate export step, no reformatting.
trivy sbom / trivy image --format cyclonedx.externalRefs purls.pkg: package URLs in its output works here.Common questions
Does this replace Trivy or Grype?
No — think of it as complementary. Trivy and Grype resolve full semantic-version ranges against their own vulnerability databases and are built for CI pipelines. This tool checks each component's package URL against Exploit Observer's VEDAS-clustered database using exact identifier matching, entirely from a browser, with nothing to install.
It's a fast way to check an SBOM you already have — not a replacement for scanning in CI.
What SBOM formats are supported?
CycloneDX (JSON or XML) and SPDX (JSON or tag-value), including exports from Trivy, Grype,
Syft, cdxgen, and most other SBOM generators. The scanner extracts every package URL
(pkg: purl) it finds in the uploaded file, so any format that embeds them works.
Is my SBOM uploaded to a server?
No. The file is parsed entirely in your browser using the File API. Only the extracted package identifiers — not the file itself — are sent to the Exploit Observer API for lookup.
Why is scanning slow?
The free, anonymous Exploit Observer API is rate-limited to 2 requests per minute per IP, and each component is one request. A 50-component SBOM takes roughly 25 minutes on the free tier. An API key raises that limit substantially for larger SBOMs.
What does "clean" actually mean?
No vulnerability record was found for that exact package-and-version identifier in VEDAS. That's a real signal, but it isn't the same as a full semver-range CVE match the way Trivy or Grype compute it — a differently-versioned build of the same package could still be affected. Treat this as a fast first pass, not a final verdict.
What does the Maturity score mean?
VEDAS's exploit maturity score (0–100%) for the vulnerability cluster matched to that component — how exploitable it appears to be in practice, not just in theory. It's the same score shown on Exploit Observer's main lookup. When a component matches more than one cluster, this shows the score for the first (most relevant) match.
Premium access
Scanning a large SBOM? API keys start at $200/month and raise the rate limit substantially.