Alerts you can verify: OSV, KEV, EPSS
LibTracker combines public sources to answer three questions about every dependency in your projects: does it have known vulnerabilities, is one of them actively exploited, and how likely is it to be exploited soon?
Four public sources, combined for every dependency
Known vulnerabilities
OSV.dev
The open vulnerability database for open source, which aggregates the GitHub Security Advisories, PyPA, RustSec and the Go vulnerability database, among others. Every tracked dependency is checked against it every 15 minutes.
View the sourceActively exploited vulnerabilities
CISA KEV catalog
The list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities with confirmed exploitation in the wild.
View the sourceExploited vulnerabilities, the European view
ENISA's EUVD
ENISA's European Vulnerability Database, which consolidates the CISA KEV catalog and the European Union's own catalog. LibTracker retrieves both catalogs through it.
View the sourceExploitation probability
FIRST EPSS
A model that estimates the probability that a published CVE will be exploited within 30 days, updated daily by FIRST.
View the sourceThe three signals, in plain words
A CVE is the public identifier of a vulnerability. The CVSS score measures its theoretical severity, from low to critical.
Known Exploited Vulnerabilities: attackers are already exploiting the flaw. It comes first, whatever its CVSS score.
Exploit Prediction Scoring System: the probability, as a percentage, that the flaw will be exploited within the next 30 days. LibTracker flags vulnerabilities above 70%.
How an alert reaches you
- 1
Your dependency files
You send your lockfiles and manifests from the app, the API or your CI. LibTracker never reads your source code.
- 2
Continuous checks
Every tracked dependency is checked against OSV.dev every 15 minutes. The KEV status and EPSS score of each vulnerability are refreshed separately.
- 3
Alert in under an hour
A new vulnerability in one of your dependencies is sent to you on Slack, Discord or by email depending on your plan, with its severity. Vulnerabilities that enter a KEV catalog or go above 70% EPSS are flagged in the app (status refreshed every 6 hours).