Dependency scanning (SCA)

Software Composition Analysis (SCA) inspects the open-source libraries your project depends on and flags any with known vulnerabilities (CVEs) or risky licences.

Most modern applications are mostly third-party code, so this is one of the highest-leverage scans you can run.

SecNxt reads your dependency manifests and lockfiles to build a dependency tree — npm (incl. lockfiles), PyPI/Pipfile, Maven & Gradle, Go modules, Cargo, RubyGems, Composer and NuGet — including transitive dependencies for npm and PyPI.

Each package version is checked against the live OSV.dev advisory database, with semantic-version range matching to suppress CVEs your installed version isn't actually affected by.

Confirmed CVEs are then enriched with real-world exploit intelligence: CISA KEV (Known Exploited Vulnerabilities) flags issues under active attack, and FIRST EPSS adds a 30-day exploitation probability. KEV/high-EPSS issues are escalated so you fix the few that matter, not just the loudest CVSS scores.

1. 1Pick 'Dependency Scan' on the New scan screen.
2. 2Point it at your project's manifest/lockfile or repository.
3. 3Run the scan.
4. 4Review flagged packages and the recommended safe versions.
5. 5Upgrade the affected dependencies and re-scan.

• Responding quickly when a new CVE drops in a popular library.
• Keeping a software bill of materials (SBOM) clean.
• Avoiding licence-compliance surprises.

• Prioritise dependencies that are actually reachable and exploitable, not just every CVE.
• Automate SCA in CI so new vulnerable dependencies are caught at PR time.

What if there's no fixed version yet?

Look for mitigations (config changes, removing the feature, or an alternative package) and track the finding until an upgrade is available.

What do the KEV and EPSS labels mean?

KEV means the CVE is in CISA's Known Exploited Vulnerabilities catalogue — it is being actively exploited in the wild, so fix it first. EPSS is a 0–100% probability that the CVE will be exploited in the next 30 days. Together they cut through CVE noise to the issues that pose real, present risk.