Do you know which vulnerabilities are hiding in your dependencies?
Since September 11, 2026, the Cyber Resilience Act requires you to report any exploited vulnerability to authorities within 24 hours. If you don't know you're affected, you can't respond in time.
LibTracker monitors your dependencies continuously and alerts you as soon as a CVE affects you.
What the CRA actually requires
A vulnerable dependency is being actively exploited in the wild. The regulatory clock starts ticking.
Your application relies on hundreds of dependencies. One of them, direct or transitive, is vulnerable and actively exploited. CRA Art. 14 demands an immediate response.
Early warning to your national CSIRT and ENISA: who you are, which product is affected, which vulnerability.
Full notification: estimated impact, corrective measures underway, scope affected.
Final report: root cause, deployed fix, actual impact, threat actor information.
To meet these deadlines, you first need to know you're affected. Without a dependency inventory and CVE monitoring, you'll find out too late.
Are you exposed?
How LibTracker prepares you for the CRA
Four building blocks available today.
Automatic SBOM
Generate a complete dependency inventory in CycloneDX or SPDX. 9 languages supported, transitive dependencies included.
Real-time CVE alerts
Every new CVE is matched against your dependencies. Slack, Discord, or Email alert within one hour.
CI/CD integration
Automatic scan on every push. Read-only API token. Operational in 5 minutes.
CRA Art. 14 Reporting
availableImmediate alert when one of your dependencies is actively exploited (CISA KEV catalog) or has a high probability of exploitation within 30 days (EPSS). Pre-filled declaration templates coming next.
LibTracker automates detection and alerting. Reporting to authorities remains your responsibility. We give you the tools, not the certification.
Built for European compliance
Hosted in France
OVH infrastructure, data on French soil, GDPR compliant.
Official data sources
CVE data from ENISA (EUVD), CISA KEV, and OSV. No black box.
Source code never transmitted
Only your lock files are analyzed. Your code never leaves your environment.
What you risk for non-compliance
€15M
or 2.5% of global revenue
Withdrawal
from the European market
Public
publication of sanctions