SBOM audit over the API, a redesigned SBOM Audit page and uv.lock

Released January 31, 2026

SBOM files can be audited over the API from this release on. The SBOM Audit page was redesigned at the same time, and package audit learned to read uv.lock. This entry covers December and January together.

SBOM audit over the API

Send an SPDX 2.x or CycloneDX 1.x file in JSON, up to 100 MB, to POST /api/v4/audit/sbom. For every component the response gives the version found, the matching advisories and the latest known fixed version.

curl -X POST "https://vulners.com/api/v4/audit/sbom" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  -F "file=@/path/to/sbom.json"

Docs: SBOM audit

A redesigned SBOM Audit page

The page gained an AI score filter. Clicking a severity in the breakdown narrows the list to that severity. Teams that don’t have an SBOM yet will find a step-by-step guide to generating one on the same page.

uv.lock in package audit

Python projects managed with uv can send uv.lock as is. The endpoint sits next to the ones for pip, Poetry, npm, Maven and Go.

curl -XPOST https://vulners.com/api/v4/audit/package/uv \
     -H "X-Api-Key: YOUR_API_KEY" \
     -H "Content-Type: text/plain" \
     -d "$(cat uv.lock)"

Docs: Package audit

Sources and data

Nozomi Networks, the OT and IoT security vendor, is a new source. OSV advisories carry CVSS v2, v3 and v4 scores parsed from their severity vectors. FreeBSD advisories add structured version ranges for each affected package. CVE records also carry the CPE applicability data that the CNA publishes in the record itself, as cnaCpeApplicability.