Skip to content
Declarable

SBOM and vulnerability monitoring

Know when a new vulnerability reaches your firmware.

Embedded SBOMs rarely carry the identifiers vulnerability databases match on. Declarable adds them where its mapping rows know the component, checks every release against the public feeds, and tells you when a new record matches something you ship.

Check an SBOM, freeSee pricing

Included in Maker, Studio and Fleet.

Products · Demo sensor firmware 1.0.0Demo data

Products / demo-sensor-firmware.cdx.json

Demo sensor firmware 1.0.0

4 components
Known vulnerabilities matched to the demo firmware
SeverityVulnerabilityComponent
CriticalCVE-2022-37434zlib@1.2.11
HighCVE-2018-25032zlib@1.2.11
HighCVE-2024-28960mbedtls@2.28.0
  • Annex I Part II (1)Some components cannot be looked up
  • Annex I Part II (1)Some components have no version
  • Annex I Part II (2)Components have high or critical severity vulnerabilities
A worked example. The firmware is made up; the checks, the CVE records and the deadline arithmetic are the real ones.

What it does

SBOM monitoring, in 6 parts.

  1. 01

    Identifiers fixed before matching

    Components from west spdx, create-spdx or esp-idf-sbom often arrive without a package URL or CPE. Where the mapping rows know the component, Declarable adds them and shows you what it added.

  2. 02

    Five public feeds, plus exploit scoring

    Each component is checked against the CVE List, ENISA’s EU Vulnerability Database, GitHub Security Advisories, OSV and CISA’s Known Exploited Vulnerabilities catalogue, with the EPSS score beside it.

  3. 03

    Checked again every day

    We check your components against newly published vulnerabilities every day. Free is checked at least once a month.

  4. 04

    Alerts by email, Slack or webhook

    A new match sends an email, and can post to a Slack channel or your own webhook. A weekly summary says what opened, what closed and which products near the end of their support period.

  5. 05

    Your decision recorded on each finding

    Mark a finding fixed, mitigated or not affected, with your reason. Hide a known false match with a suppression, and get reminded when it is due for another look.

  6. 06

    A VEX file from your decisions

    Download a CycloneDX 1.6 VEX for any release. It states only the decisions you made; findings nobody has looked at yet are left out, and the file says how many.

How it works

Three steps, the same every release.

  1. 1

    Upload the SBOM

    Drop the files your build writes, or send them from CI. SPDX and CycloneDX in JSON, XML or tag-value are read as they are.

  2. 2

    Review what matched

    Findings are listed by severity with the record’s own summary. Gaps against Annex I sit beside them, each citing its article or annex.

  3. 3

    Let it watch between releases

    The current release is re-checked as new records are published. You hear about new matches; you do not have to remember to look.

What it does not do

  • It does not decide whether a vulnerability affects you. A match is a lead; the decision is yours.
  • It does not scan your binaries or source code. It reads the SBOM your build produces.

Questions

Questions about SBOM monitoring.

Which SBOM formats does Declarable read?

SPDX 3.0.1 and SPDX 2.2 and 2.3 (JSON and tag-value), CycloneDX 1.1 to 1.6 (JSON and XML), Buildroot show-info and .config, Arduino and PlatformIO projects.

Why do firmware SBOMs miss vulnerabilities?

Vulnerability databases match on package URLs and CPEs, and embedded build tools often leave them out. Without them a component cannot be matched at all, so it looks clean when it is simply unknown.

How often is my product checked?

We check your components against newly published vulnerabilities every day. Free is checked at least once a month.

Can I try it without an account?

Yes. The free SBOM check runs in your browser. Only component identifiers leave it, and only when you ask for the vulnerability lookup.

The rest of Declarable

What Declarable is, and what it is not

  • A documentation aid. Declarable prepares drafts and checklists for you to review and edit.
  • Not legal advice. For a legal question about your product, ask a lawyer.
  • Not certification. Nobody at Declarable assesses or signs off your product. You sign your own declaration of conformity.
  • Not an assessment body. Some products need an outside assessment body: an product unless its maker fully applies a harmonised standard or one of the alternatives in Article 32(2), and those on the CRA's Annex III class II and Annex IV lists — the higher-risk product categories, where self-assessment is not enough. Declarable is not one. The scope check asks the questions that point to your category.
  • Not a filing agent. Declarable does not file reports for you. You submit them yourself on the ENISA platform.

Source for the assessment lists and when an outside body is needed: Annexes III and IV and Article 32 of Regulation (EU) 2024/2847 (Cyber Resilience Act), as recorded in legal state 2026.10.13-1.

Start with the free tool. Keep the record when you are ready.

Check an SBOM, freeSee pricing