vex-hub

Free & Open Source

vex-hub

See which vulnerabilities actually matter

Vendors

CVEs

Statements

Product mappings

Aggregating vendor VEX from

OracleAmazon

Search by CVE

Enter a CVE ID to see every vendor statement for it.

Upload SBOM and / or VEX

Drop an SBOM, a VEX document, or both. Either one works on its own.

Drop CycloneDX SBOM

.json with vulnerabilities and components

Drop VEX

OpenVEX 0.2.0 or CycloneDX VEX

Analyzedrop at least one file

Or via APIcopy

jq '{sbom: .}' sbom.json | \
  curl -X POST https://vex.getreel.dev/v1/analyze \
  -H "Content-Type: application/json" \
  -d @-

Example

sample-sbom.jsonCycloneDX: log4j + Ubuntu 24.04 base · 9 CVEs, critical to medium, mixed verdictssample-user-vex.jsonOpenVEX: user mitigations for log4j and libxml2

Or generate an SBOM: `reel export sbom --scanners vuln --image <ref> > sbom.json`

What you put in shapes what you get out:

| You provide | You get back | | --------------------------------------- | ------------------------------------------------------------------------------------ | | CycloneDX SBOM with vulnerabilities\[\] | CycloneDX SBOM, annotated with the vendor verdict on each listed vulnerability. | | CycloneDX SBOM components only | CycloneDX SBOM, with vulnerabilities filled in from vendor data, then annotated. | | VEX only (OpenVEX or CycloneDX) | OpenVEX document, your statements merged, with the vendor's view alongside. | | SBOM + VEX | CycloneDX SBOM, annotated, with your VEX overriding the vendor verdict on collision. |

What is VEX?

A scanner hands you a long list of CVEs. Vendors publish a verdict on each one, saying whether it really affects their product. VEX carries that verdict, so you can clear the ones that do not apply.

Not Affected

The vendor confirms the CVE does not reach their product. You can suppress it.

Fixed

A patched version is out. Update to clear it.

Under Investigation

The vendor is still assessing impact. Keep an eye on it.

Affected

The vendor confirms the product is exploitable. Plan a fix.

Where the statements come from

vex-hub pulls verdicts from the vendors below. Here is what it covers today.

| Vendor | Coverage | Feed | | -------------- | ---------------------------------------------------- | -------------- | | Red Hat | RHEL plus EUS, AUS, and E4S extended-support streams | CSAF · OVAL | | SUSE | SUSE Linux Enterprise and openSUSE | CSAF | | Ubuntu | 20.04, 22.04, 24.04 LTS plus Ubuntu Pro ESM tracks | OpenVEX · OVAL | | Debian | 11 (bullseye), 12 (bookworm), 13 (trixie) | OVAL | | Rancher (SUSE) | SUSE cloud-native product images, scoped per product | OpenVEX | | Alpine | Alpine Linux 3.19 through 3.23 (main and community) | secdb | | Amazon Linux | Amazon Linux 2 and 2023 | ALAS | | AlmaLinux | AlmaLinux 8, 9, and 10 | OVAL | | Oracle Linux | Oracle Linux 8, 9, and 10 | OVAL |

`/v1/statements` takes more filters: vendors, statuses, source formats, `since`, and more. The full API reference, response shape, and recipes live in docs/api.md.

Open Source

The VEX resolution service is free and open source under Apache 2.0.

View on GitHub