SBOM AI summaries, PDF reports and transitive dependency advisories
Released March 31, 2026
SBOM reports come with an AI-written summary and download as PDF. A new advisory type flags packages that may be affected through a vulnerable dependency.
An AI summary for your SBOM report
Reports include a summary written by an AI model from the report’s own data: CVE counts, exploitation flags, EPSS scores and upgrade paths. Very large reports are skipped. The summary follows the vocabulary of the EU Cyber Resilience Act. Actively exploited vulnerabilities are listed separately from exploitable ones, and findings that may need a report under Article 14 are pointed out. Treat it as a starting point for that work, not as legal advice.
PDF reports
Under “Download report as”, the .pdf option turns an SBOM report into a file you can attach to an audit or a reply to a customer.
Vulnerabilities that arrive through dependencies
When a library has a known vulnerability, the packages that depend on it may be exposed too, and their own advisories rarely say so. For vulnerabilities published in OSV, Vulners OSV advisories list the packages that depend on the affected library, directly or through other packages, under titles like “X potentially affected by CVE via Y”. They cover PyPI, npm, Maven and Cargo.
Exploitation data
- CISA KEV records, and the exploitation data on CVEs, include CISA’s
knownRansomwareCampaignUseflag. - In-the-wild exploitation sources on a CVE carry a
firstSeendate, the earliest publication date among that source’s records.
Smaller changes
- ZDI advisories carry CVSS scores taken from the advisory page.
- Red Hat advisories include the description note for each CVE they cover.
- Rocky Linux advisories use the unified package format, with the RPM epoch kept in versions.
- Liferay and Lenovo join the CNAs whose CVE records get CPE configurations from their own data.