# sbomify Insights

> Every known vulnerability in plain English: what it is, who is affected, whether it is being exploited and how to fix it. Built by sbomify (https://sbomify.com/), the Security Artifact Hub.

Every vulnerability has one page at https://insights.sbomify.com/<ID>/ where <ID> is a CVE, GitHub (GHSA), OSV or malicious-package (MAL) id. Other ids for the same flaw redirect there.

Machine-readable versions of every page:

- Markdown: append `index.md` to any page URL, for example https://insights.sbomify.com/CVE-2021-44228/index.md
- JSON (vulnerability pages): append `index.json`, for example https://insights.sbomify.com/CVE-2021-44228/index.json
- Each vulnerability's Markdown ends with a ready-made prompt for an AI coding agent to find and fix it in a codebase.

## Browse

- [Home](https://insights.sbomify.com/index.md): exploited recently and how to browse
- [Exploited in the wild](https://insights.sbomify.com/exploited/index.md): the CISA Known Exploited Vulnerabilities catalog
- [Latest](https://insights.sbomify.com/latest/index.md): newly published CVEs
- [By year](https://insights.sbomify.com/years/index.md): every vulnerability, by year published
- [By type](https://insights.sbomify.com/types/index.md): SQL injection, cross-site scripting and more
- [Package ecosystems](https://insights.sbomify.com/ecosystems/index.md): PyPI, npm, Maven, Go
- [Products](https://insights.sbomify.com/products/index.md)
- [About the data](https://insights.sbomify.com/about/index.md): sources, method and how often it updates

## Notes

- Summaries and labels are generated from the official records and may contain mistakes; each page includes the official description.
- Data from the CVE List, NVD, GitHub Advisory Database, RustSec, OSV, Linux distribution advisories, OpenSSF Malicious Packages, CISA KEV, EPSS by FIRST, Metasploit, Exploit-DB, Nuclei and MITRE CWE.