usefulweb.site Dependency Vulnerability Explorer

Security & supply-chain explorers

Dependency Vulnerability Explorer

Known vulnerabilities in your dependencies, and the version that fixes each one.

Try an example: Two outdated packages · Look up an advisory

How it works

Reads npm (package.json, package-lock.json), Python (requirements.txt), Go (go.mod), Rust (Cargo.lock) and PHP (composer.lock) manifests, or lines like npm:lodash@4.17.20, and checks every exact package version against OSV.dev, the open vulnerability database that aggregates GitHub Security Advisories, PyPA, RustSec, Go and more. For each finding: severity, aliases (CVE/GHSA), and the nearest fixed version. You can also look up a single advisory ID.

  • Exact versions come from lockfiles and == pins; for version ranges (^1.2.0, >=2.0) the lower bound is checked and the package is marked exact=false.
  • Each package@version is sent to the OSV.dev querybatch API; details for up to 60 distinct advisories are fetched from /v1/vulns/{id}.
  • Severity is the advisory database rating (GHSA: LOW/MODERATE/HIGH/CRITICAL); the CVSS vector is shown when published. fixedIn = the lowest fixed release above your version for that package; upgradeTo = the highest of those across a package's advisories.
  • Advisories are matched by OSV's version ranges; withdrawn advisories are not returned by OSV.

For scripts and AI agents

  • JSON API: POST https://dependencyvulnerabilityexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://dependencyvulnerabilityexplorer.usefulweb.site/mcp · tool name dependency_vulnerability_explorer
Example request
curl -s -X POST https://dependencyvulnerabilityexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"manifest":"npm:lodash@4.17.20\npypi:requests@2.19.0"}'

Related tools

  • OpenAPI Diff Explorer – Compare two versions of an OpenAPI spec and see exactly which changes break clients.
  • Explorer of Everything – Search transactions, contracts, domains, packages, advisories, MCP servers and websites in one box.
Feedback