CRA Exploited-Vulnerability Evidence and Art. 14 Deadline Clock

Overview

Takes a CycloneDX or SPDX JSON SBOM (or a purl list), asks OSV.dev for the advisories that affect each exact component version (OSV evaluates the version ranges per ecosystem), then checks each CVE against the CISA Known Exploited Vulnerabilities catalog and the ENISA EUVD exploited-vulnerability index, and adds FIRST EPSS scores. Returns a per-component verdict, the evidence with source URLs and SHA-256 digests, and the Regulation (EU) 2024/2847 Article 14(2) dates computed

Health