Skip to main content

SBOM Upload

Even without access to the source or image, knowing just the components lets you see the risk. Upload an SBOM (Software Bill of Materials) already built by another tool or pipeline, and it analyzes the known vulnerabilities (CVEs) and license risk of the listed packages. Useful when code is hard to access, such as in air-gapped networks or third-party artifacts.

Supported formats​

  • CycloneDX (JSON/XML)
  • SPDX (JSON/tag-value)

Registration steps​

  1. On the [Services] page, click Register service and select SBOM upload.
  2. Upload the SBOM file.
  3. When run, SCA (CVE) and license analysis are performed per component.

Register service: select SBOM upload

What it finds​

  • Component vulnerabilities : Known CVEs in the packages listed in the SBOM. Items with confirmed active exploitation are marked KEV, and each item comes with EPSS (exploitation probability) and CWE (type classification) information to help decide the remediation order.
  • License risk : Sorted by risk order, such as Copyleft (GPL, etc.) and Unknown. (More on license risk)

SBOM component inventory

Continuous monitoring​

The components of the uploaded SBOM become subject to continuous monitoring. Later, when a new CVE is published, it is incorporated into the inventory and an alert is raised even without rescanning. (Security News)

How do I create an SBOM?

If you register a source code/image service, Vulinder generates the SBOM automatically. You can also upload a CycloneDX/SPDX file created by an external SBOM generation tool here.

Next steps​

Use the resultsVulnerability managementReview findings, mark false positive/accepted riskUse the resultsSecurity NewsContinuous monitoring alerts for new CVEsReferenceLicense riskCriteria for judging copyleft/unknownOther typeContainer imagesAutomatic SBOM generation from imagesOther typeSource codeAutomatic SBOM generation from repositories