Vayron — VBOM · Managed SBOM & Vulnerability Service

Art. 14 Reporting Clock

24h early warning · 72h notification · final report per Art. 14(1)/(3) branch

Assessment Queue

—

CRA Readiness v2

—

VEX Coverage

0% 0 / 0 findings

Exploitation Reported

—

Exploitable

—

confirmed by VEX analysis

Likely Next

—

EPSS > 50% · not in KEV

Triage Backlog

—

VEX Coverage

—

Exploitation-Reported Findings

CISA KEV ∪ ENISA EUVD — feed signal, assessment required

Triage Funnel

Product Compliance

Product	Status	Exploit. Reported	Exploitable	Unreviewed	VEX Cov.	Crit / High	Components	SBOM

Exploitation & Backlog Trend

90 days · daily warehouse snapshots

CVE	Severity	Threat	EPSS	Tenants	Components	Findings

Tenants

—

Products

—

Open Criticals

—

KEV Hits

—

VEX Backlog

—

Blast Radius

—

Tenant	Products	Critical	High	KEV	VEX backlog	SBOM age	Health

Product / Version	CRA class	PCS	Purdue zone	Exposure	Components	Vulnerabilities	Last import

Component	Products	Vulnerabilities

CVE / ID	Sev	CVSS	EPSS	Published	Component	Product	Analysis	Threat

	CVE / ID	Sev	CVSS	Component	Product	VEX State	Threat

CVE / ID	Sev	CVSS	Product	VEX State	Reporting status

This session

Time	Event	Detail	User
No activity this session yet

SBOM import history

Product	Version	Imported	Components	Vulnerabilities

Suppression events

Time	CVE	Component PURL	Product	VEX State	Justification	Comment	Analyst

Platform

—

checking…

Dependency-Track

—

checking…

DT Version

—

dependency-track

Products enrolled

—

in DT portfolio

Administration

Vulnerability feeds

NVD — National Vulnerability Database active

OSV — Open Source Vulnerabilities active

GHSA — GitHub Security Advisories active

CISA KEV — Known Exploited Vulnerabilities active

EPSS — Exploit Prediction Scoring enrichment

ENISA EUVD — EU Vulnerability Database active

Refresh ↻

Username	Full name	Email	Company	Type

Product

—

Refresh ↻

Components

—

in SBOM

Critical

—

findings

High

—

findings

Medium

—

findings

Low

—

findings

VEX Coverage

—

audited

Export CSV ↓

CVE ID	Severity	CVSS	Component	VEX State

Security advisories from Siemens ProductCERT, CISA ICS-CERT, CERT@VDE, and Rockwell Automation, refreshed every 6 hours. CVE IDs cross-referenced against your portfolio — red rows indicate active impact. Note: Siemens CVE IDs are not published in their RSS feed; click "Open →" for full advisory details.

Advisory	Vendor	Severity	CVE IDs	Published	Portfolio

Drop SBOM file here

CycloneDX 1.5 / 1.6 or SPDX 2.3 — JSON or XML

cdx.json cdx.xml spdx.json spdx.xml .sbom

or

sbom-v4.2.1.cdx.json 248 KB

Validating schema… 0%

Product metadata

Product

Version

CRA classification

Product Criticality Score (PCS)

Purdue Zone (IEC 62443)

Network Exposure

Comment

Stored immutably · EU-region object storage
sha256 hash recorded to audit trail on ingestion

Recent uploads

View all →

Product / version	PCS	CRA class	Format	Components	Vulns	Last Import

SBOM Repository

Export CSV ↓

All CycloneDX JSON CycloneDX XML SPDX

Product / Version	Format	Size	Uploaded	TR-03183-2