vulns / check your stack

What in your lockfile is vulnerable?

Upload a lockfile, or an SBOM of a container image, and see every known vulnerability affecting the exact versions you pin, with the ones attackers are exploiting first. You also get a private report page and a feed that tells you when a new one lands.

upload paste package list

List packages as ecosystem:name@version, comma-separated, and get a feed for exactly those versions. Nothing is stored, so it suits scripts and CI.

feed url

https://vulns.fencer.dev/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0

Add &format=atom or &format=json for other formats, or POST a lockfile to /api/v1/stack (see the API docs).

How it works

01

Drop a lockfile or SBOM

It is parsed on the server for exact pinned versions; the file is discarded and only the package list is kept, for the report.
02

Get the report

Every known advisory for those versions, known exploited first, then critical, then by severity and date. Versions out of support (endoflife.date) are flagged too.
03

Subscribe

The report has its own RSS feed, so a new advisory for any of your packages shows up in your reader.

Supported files

npm: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock
pypi: requirements.txt, poetry.lock, uv.lock, Pipfile.lock
crates.io: Cargo.lock
go: go.sum
rubygems: Gemfile.lock
packagist: composer.lock
hex: mix.lock
nuget: packages.lock.json
maven: gradle.lockfile
github-actions: .github/workflows/*.yml, action.yml
pub: pubspec.lock
swift: Package.resolved
cran: renv.lock
julia: Manifest.toml
hackage: cabal.project.freeze
opam: *.opam.locked

Variants such as requirements-dev.txt work too.

Container SBOMs too (CycloneDX JSON, SPDX 2 JSON, Syft JSON): syft <image> -o cyclonedx-json.

Workflows: each uses: is checked at its tag. A floating tag such as v4 counts as the newest release of its line; actions pinned to a commit or a branch are listed as not version-checked, unless the commit carries a tag comment (# v4.1.2).

What we keep

The file itself is discarded once it's parsed. Fencer Vulns stores the package names, versions and file name, so the report and its feed can work. Reports are unlisted and not indexed, but anyone with the link can read them. A report nobody opens, and whose feed nobody reads, for 90 days is deleted.