November 2, 2026

Scan Your App for CVEs in 3 Steps

Your Dependencies Are Getting CVEs Faster Than You Can Read Them. Scan Your App in 3 Steps

By Ashish Sen

3 min read

Your Dependencies Are Getting CVEs Faster Than You Can Read Them. Scan Your App in 3 Steps

The situation

Vulnerability disclosures are piling up faster in 2026 than anyone planned for. FIRST projects about 66,000 CVEs this year, and the bottleneck has moved from finding flaws to fixing them. AI tools have become very good at finding bugs that sat in plain sight for years, and open source patching and disclosure models were built for a much slower pace. Microsoft's June 2026 Patch Tuesday set a record at 206 vulnerabilities, which engineers and researchers attributed to AI-assisted discovery. Angular alone had 21 security advisories in the first half of 2026, 15 of them in a two-week window. Of roughly 1,596 vulnerabilities disclosed to open-source maintainers by May 2026, only 97 had been patched.

For you, this means a Friday-evening "is our app affected?" can arrive at any time. The fix is to know what you ship before the question arrives. The numbers aren't all bad news: FIRST separates total volume from actionable exploitability, using known-exploited lists and EPSS to decide what is urgent. So scan everything, then fix the urgent ones first.

What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a public ID for a known security flaw, for example CVE-2026-109618 for a PHP2Shell bug. Each one has a severity from Low to Critical and usually a fixed version. The flaw rarely lives in your own code. Most CVEs reach you through the open-source libraries you depend on.

Why scan?

Modern apps are mostly third-party code, so one outdated library can expose the whole application. Regulators now expect you to prove you know what's inside your software and that you handle its vulnerabilities:

  • EU Cyber Resilience Act (CRA): requires an SBOM and vulnerability handling for products, with full requirements from December 2027.
  • DORA: expects financial entities to manage ICT and third-party risk.

Regular scans give you the evidence, and catch problems before attackers do.

What is Trivy?

Trivy is a free, open-source scanner from Aqua Security. It reads your dependency list, matches it against vulnerability databases, and reports which CVEs affect you, with severity and fixed versions. One CLI command, works in CI.

What is an SBOM?

A Software Bill of Materials is the ingredient list of your application: every library and its version. We use the CycloneDX format. Generate it from the build tool, not from the final JAR or bundle, because the build tool knows the real dependency tree. Include only what ships, with no test or dev dependencies.

How to create an SBOM

Maven

mvn org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeAggregateBom \
  -DprojectType=application \
  -DincludeTestScope=false -DincludeProvidedScope=false \
  -DschemaVersion=1.5
# output: target/bom.json

Gradle

Add to build.gradle:

plugins {
    id 'org.cyclonedx.bom' version '1.7.4'
}
cyclonedxBom {
    includeConfigs = ["runtimeClasspath"]
    projectType = "application"
    schemaVersion = "1.5"
    outputFormat = "json"
    outputName = "bom"
}
./gradlew cyclonedxBom
# output: build/reports/bom.json

JavaScript / TypeScript

The SBOM tool reads your installed dependencies. To install them reproducibly you need a lockfile, which records the exact version of every package. Check for one:

ls package-lock.json yarn.lock pnpm-lock.yaml

Lockfile exists: install exactly what it says.

npm ci                              # npm
yarn install --frozen-lockfile      # Yarn
pnpm install --frozen-lockfile      # pnpm

npm ci (clean install) installs the exact locked versions and fails if package.json and the lockfile disagree. That is what you want, because you scan what really ships.

No lockfile: npm ci will fail. Generate one first.

npm install --package-lock-only     # creates package-lock.json, downloads nothing
npm ci

Without a lockfile, versions are resolved fresh from today's registry, so results may differ from what is deployed.

Then create the SBOM (production dependencies only):

npx @cyclonedx/cyclonedx-npm --omit dev --spec-version 1.5 \
  --mc-type application --output-format JSON --output-file bom.json

Yarn: npx @cyclonedx/cyclonedx-node-yarn --production --output-file bom.json pnpm: npx @cyclonedx/cyclonedx-node-pnpm --prod --output-file bom.json

How to scan with Trivy and get an HTML report

Quick check in the terminal:

trivy sbom --severity HIGH,CRITICAL bom.json

HTML report:

# one-time: download Trivy's HTML template
curl -sSLo html.tpl https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl
trivy sbom --severity HIGH,CRITICAL \
  --format template --template "@html.tpl" \
  -o report.html bom.json

Open report.html in a browser. Add --exit-code 1 to fail your CI build when findings exist.

Sources