Vulnder

Someone's into your stack. See who, ranked by real-world exploitation.

Checking data freshness…

Privacy

Vulnder does not store your stack or what you type. Free text is sent to Workers AI to pick out component names; the parsed result is cached under a hash of the text, never the text itself. Manifest files are read in your browser, and only package names and versions are sent. Stack links are not written to logs. Vulnder is hosted on Cloudflare, which processes every request to run the service, including the stack in the page address. If you mark items as internet-facing, the link says so too, so treat a stack link like a list of what you run and share it with care. No analytics or tracking scripts are used.

Data: CVE records (MITRE), GitHub Advisory Database, CISA KEV, EPSS scores courtesy of FIRST, and OSV for version checks. EPSS is a predicted probability of exploitation in the next 30 days, not evidence of exploitation.