CRA vulnerability handling, made boring.
Since 11 September 2026, exploited vulnerabilities must be reported within 24 hours. boring.tools watches your SBOMs and drafts the reports.
CVE-2026-45321
CISA KEVENISA EUVDActively exploited in Lagerwerk Portal, detected 3 h ago
Early warning
NextWithin 24 hours of detection
due in21:13:52
Notification
due in 2 days
Final report
waiting for a fix
- AI pre-wrote the report draft2 h ago
- Emailed owners and admins3 h ago
- Detected as actively exploited3 h ago
The CRA turned dependency updates into a legal deadline
And in most companies, one person ends up owning it, next to everything else.
0 h
You become aware
An actively exploited vulnerability in a product you sell.
24 h
Early warning
To your CSIRT and ENISA, naming the member states where the product is sold.
72 h
Notification
The product, the vulnerability and exploit, the measures taken.
Fix + 14 days
Final report
Severity and impact, the attacker if known, the security update.
The 24-hour clock is running
An actively exploited vulnerability in a product you sell has to be reported within 24 hours. You can't report what you don't know you ship.
Hundreds of findings, one person
Every scanner finds something. Deciding what actually affects your product is the slow part, and it starts over with every release.
Proof on request
Customers and authorities ask what you knew and what you decided. A spreadsheet and a Slack thread won't answer that.
Three steps. Then it gets boring.
Set it up once in your pipeline. Look at it when it matters.
Upload
Your build already produces an SBOM (cyclonedx-npm, cdxgen, Syft …). One curl call in CI sends it to boring.tools. No agent, no repository access.
Watch
Every component is matched against OSV. When the vulnerability data changes, your versions in support are re-checked on their own.
Decide
AI suggests a VEX status with its reasoning, you accept or reject. Every decision is kept with its history and exported as OpenVEX.
sbom-upload#482
v2.4.0 · 3f9a2c1 · push
- Set up job
- Checkout repository
- Generate SBOM
- Upload to boring.tools
- Complete job
█What works today
Everything on this list is in production use.
See
What you ship and what affects it.
CI upload in one call
CycloneDX or SPDX JSON via upload keys that belong to your organization, scoped to one project or all of them. Snippets for GitHub Actions and GitLab CI.
Continuous matching
Components are matched against our OSV copy, checked for updates every five minutes, with the version rules of each ecosystem. Versions in support are re-analysed automatically.
Exploited first
Findings listed in CISA KEV or ENISA EUVD as actively exploited come first, then by EPSS. A CVSS 5 that is being exploited beats a theoretical 9.8.
Dependency graph
Direct or transitive, and which direct dependency pulled it in. So you know which upgrade actually fixes a finding.
Decide
What actually affects your product, on record.
VEX triage with history
Affected, not affected, fixed or under investigation, with justification. Decisions belong to the release, so they survive new uploads.
AI pre-triage
Suggestions based on your deployment profile, with a confidence and a monthly budget. A person always makes the final call.
OpenVEX export & fix hints
Export your decisions as OpenVEX for customers. For npm, get the upgrade command that resolves a finding.
Report
Deadlines, drafts and reminders under Art. 14.
CRA reporting cases
An exploited vulnerability in a product opens a case with the Art. 14 clock: early warning in 24 h, notification in 72 h, final report after the fix. Each step comes with a pre-filled draft to paste into ENISA's platform.
Quiet alerts
An email when a case opens and before each deadline, otherwise one short digest on Mondays, and only when there is something to look at.
Your data stays in formats you can take with you
SBOMs in, VEX out. No proprietary lock-in.
In
CycloneDX
SBOM import (JSON)
SPDX
SBOM import (JSON)
OSV, KEV, EUVD, EPSS
vulnerability and exploit data
Out
OpenVEX
VEX export
CSAF 2.0
in progress
In progress
Next: the rest of the CRA chain
We're building these next. They are not available yet.
CSAF 2.0 export
The VEX format German industry customers and the BSI expect, generated from the same decisions.
CRA status per product
A traffic light and a monthly PDF for management: SBOM current, findings handled, deadlines met.
SBOM quality check
Every upload scored against BSI TR-03183-2, with the fix for each gap.
How it stacks up
An honest comparison with what most teams use today.
| boring.tools | Dependency-Track | Spreadsheet | |
|---|---|---|---|
| Continuous CVE matching on SBOMs | |||
| Triage decisions with history | manual | ||
| AI pre-triage, human decides | |||
| Nothing to operate | |||
| CRA reporting workflow (Art. 14) | manual | ||
| CSAF export | in progress | ||
| Self-hosting | planned |
Is boring.tools ready for production use?
Yes. Upload, matching, triage, the CRA reporting cases with email alerts and the OpenVEX export are in production use. CSAF export and a CRA status report are on the roadmap.
Do you generate SBOMs?
No. Your build can already do that: cyclonedx-npm, cdxgen or Syft take one line in CI. We take the CycloneDX or SPDX JSON and focus on what happens afterwards.
Which ecosystems are covered?
Matching covers npm, PyPI, Go, Maven, crates.io, RubyGems, Packagist and NuGet, each with its own version rules (semver, PEP 440, Maven-style qualifiers). Operating system packages from container images are next.
Where does the vulnerability data come from?
From OSV, which aggregates GitHub Security Advisories and the Python, Go and Rust advisory databases, among others. Whether a vulnerability is actively exploited comes from CISA KEV and ENISA's EU vulnerability database, the likelihood of exploitation from EPSS.
Does the AI decide for me?
No. It suggests a VEX status with its reasoning; a person accepts or rejects it. AI triage is optional and switched on per project.
Does boring.tools make us CRA-compliant?
No tool does that on its own. boring.tools covers vulnerability handling and the Art. 14 reporting workflow. Conformity assessment, technical documentation and secure development stay with you.
Can I self-host it?
Self-hosting is planned as an option for larger customers. Until then boring.tools runs as a hosted service.
What will it cost?
There is a free plan for one product, Starter at €149 and Business at €449 a month per organization, with unlimited users. Every new organization gets 14 days of Business to try it. See the pricing page.
How do I get access?
Sign up in the app with your work email. You get a sign-in link, there are no passwords.
Get boring about the CRA.
Start your 14-day trial. No credit card, set up in minutes.
Start free trialSign in with a link sent to your work email