Paste your previous and current SBOMs. Get the component delta, KEV-relevant hot-spots, and a CycloneDX VEX stub ready for the not-affected dispositions reviewers expect.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
SPDX (tag-value or JSON) or CycloneDX JSON.
Same format ideally; mixed formats are fine.
What you'll see after you submit
Common misconceptions
Myth: A new SBOM each release is enough.
Reality: Reviewers and customers care about deltas. Why did this component appear, why did this version bump, and what's the VEX disposition for newly surfaced CVEs?
Myth: VEX is a one-time document.
Reality: VEX evolves with each release. The expectation is a VEX stream - not a static file.
Myth: If a component isn't on KEV it doesn't matter.
Reality: KEV is a floor, not a ceiling. EPSS, vendor advisories, and your own threat-model context all feed the disposition.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
CISA adds use-after-free in Linux kernel netfilter to KEV (CVE-2026-0511)
BLE pairing bypass in widely embedded Bluetooth stack added to KEV
CycloneDX 1.6.1 errata - clarifies VEX status semantics for medical devices
SLSA v1.1 published - tightened build-provenance language for regulated industries
Build the pipeline that produces a clean diff every release.
Read FDA-compliant SBOM servicesHow does your SBOM + supply-chain program score overall?
Read SBOM Readiness scorerScore any individual dependency before you accept it.
Read Component Risk ScorecardPCCP, §524B checker, threat model, wireless profiler.
Read More tools