Everything you need for vulnerability disclosure. From SBOM ingestion to published VEX — a complete workflow.
SBOM Management
Upload CycloneDX and SPDX SBOMs. Automatically parse components, extract Package URLs, and track every dependency across releases.
Automated CVE Scanning
Every SBOM is scanned against 300,000+ known vulnerabilities from NVD and OSV. New CVEs are matched continuously as they are published.
Vulnerability Triage
Record dispositions for each CVE: Affected, Not Affected, Fixed, or Under Investigation. Add justification and impact statements.
VEX Generation
Generate VEX documents in CycloneDX, OpenVEX, and CSAF formats. Built-in approval workflow ensures quality before publication.
Compliance Ready
Meet EU CRA and US EO 14028 requirements. Generate attestation reports, track remediation SLAs, and maintain full audit trails.
Team Collaboration
Role-based access for owners, admins, and members. Email notifications for new CVE matches. Complete audit logging.
Four steps to compliant disclosure. A clear workflow from detection to publication.
1. Upload
Upload your Software Bill of Materials in CycloneDX or SPDX JSON format. Components and PURLs are extracted automatically.
2. Scan
Your components are matched against known CVEs using Package URLs. CVSS scores, EPSS predictions, and KEV status are included.
3. Triage
Review each vulnerability and record your assessment. Add justification, impact statements, and remediation timelines.
4. Publish
Generate VEX documents, submit for approval, and publish with public URLs, content hashes, and optional digital signatures.
Built for regulatory compliance.
The EU Cyber Resilience Act and US Executive Order 14028 require software producers to manage vulnerabilities and communicate findings. CVEium gives you the tools to meet these obligations.