vulkro match-cve

Checks an SBOM (CycloneDX 1.5 / 1.6 or SPDX 2.3 JSON) against the local CVE bundle.

vulkro sbom . --format cyclonedx > sbom.json   # once
vulkro update                                 # refresh the bundle
vulkro match-cve --sbom sbom.json --format table

It reads only the SBOM and ~/.vulkro/data/cves/. Nothing leaves the machine.

Flags

Flag	Description
--sbom <FILE>	The SBOM JSON file. Required.
--format <FORMAT>	json (default) or table.

Exit codes

0 no findings. 1 findings. 2 IO error.

See also: vulkro sbom, vulkro update, Dependencies and CVEs.