Resources for SBOM and supply chain

OWASP SBOM standard for application security and supply chain use cases.

Linux Foundation SBOM and license metadata standard, published as ISO/IEC 5962.

Anchore tool that generates SBOMs from images, filesystems and archives.

Anchore vulnerability scanner that matches components against known CVEs.

Google scanner that checks dependencies against the OSV database.

Aqua Security scanner with broad CVE coverage across OS packages and language ecosystems.

Intel tool that finds known-vulnerable components in compiled binaries.

Interlynk tool that scores the quality and completeness of an SBOM.

Checks whether an SBOM meets the NTIA minimum elements baseline.

Open-source vulnerability database with an API for querying advisories by package.

The US National Vulnerability Database, the reference source for CVE records and CVSS scores.

CISA list of vulnerabilities confirmed to be exploited in the wild.

Exploit Prediction Scoring System estimating the likelihood of exploitation.

The baseline data fields the NTIA defines for a compliant SBOM.

EU regulation setting cybersecurity requirements for products with digital elements.