Free & Open Source
vex-hub
See which vulnerabilities actually matter
Aggregating vendor VEX from
Oracle
Amazon
Search by CVE
Enter a CVE ID to see every vendor statement for it.
Upload SBOM and / or VEX
Drop an SBOM, a VEX document, or both. Either one works on its own.
Drop CycloneDX SBOM
.json with vulnerabilities and components
Drop VEX
OpenVEX 0.2.0 or CycloneDX VEX
jq '{sbom: .}' sbom.json | \
curl -X POST https://vex.getreel.dev/v1/analyze \
-H "Content-Type: application/json" \
-d @-Example
Or generate an SBOM: reel export sbom --scanners vuln --image <ref> > sbom.json
What you put in shapes what you get out:
| You provide | You get back |
|---|---|
| CycloneDX SBOM with vulnerabilities[] | CycloneDX SBOM, annotated with the vendor verdict on each listed vulnerability. |
| CycloneDX SBOM components only | CycloneDX SBOM, with vulnerabilities filled in from vendor data, then annotated. |
| VEX only (OpenVEX or CycloneDX) | OpenVEX document, your statements merged, with the vendor's view alongside. |
| SBOM + VEX | CycloneDX SBOM, annotated, with your VEX overriding the vendor verdict on collision. |
What is VEX?
A scanner hands you a long list of CVEs. Vendors publish a verdict on each one, saying whether it really affects their product. VEX carries that verdict, so you can clear the ones that do not apply.
Not Affected
The vendor confirms the CVE does not reach their product. You can suppress it.
Fixed
A patched version is out. Update to clear it.
Under Investigation
The vendor is still assessing impact. Keep an eye on it.
Affected
The vendor confirms the product is exploitable. Plan a fix.
Where the statements come from
vex-hub pulls verdicts from the vendors below. Here is what it covers today.
| Vendor | Coverage | Feed |
|---|---|---|
| Red Hat | RHEL plus EUS, AUS, and E4S extended-support streams | CSAF · OVAL |
| SUSE | SUSE Linux Enterprise and openSUSE | CSAF |
| Ubuntu | 20.04, 22.04, 24.04 LTS plus Ubuntu Pro ESM tracks | OpenVEX · OVAL |
| Debian | 11 (bullseye), 12 (bookworm), 13 (trixie) | OVAL |
| Rancher (SUSE) | SUSE cloud-native product images, scoped per product | OpenVEX |
| Alpine | Alpine Linux 3.19 through 3.23 (main and community) | secdb |
| Amazon Linux | Amazon Linux 2 and 2023 | ALAS |
| AlmaLinux | AlmaLinux 8, 9, and 10 | OVAL |
| Oracle Linux | Oracle Linux 8, 9, and 10 | OVAL |
/v1/statements takes more filters: vendors, statuses, source formats, since, and more. The full API reference, response shape, and recipes live in docs/api.md.