Is anything you ship being exploited right now?

Paste a dependency file. Get an answer in seconds. This is the question EU Cyber Resilience Act Article 14 actually asks — and it's a much smaller question than "how many CVEs do I have."

Nothing is uploaded to us. This page runs entirely in your browser. Your file contents never leave your machine — package names and versions are sent to the public OSV.dev API for lookup, and the CISA KEV comparison happens locally against a mirror served from this page. There is no account, no logging, and no server of ours involved.

What this checks, precisely

Your declared dependencies are resolved against OSV.dev, and every advisory found is mapped to its CVE aliases. Those CVEs are then intersected with the CISA Known Exploited Vulnerabilities catalogue — the most widely used public register of vulnerabilities with confirmed real-world exploitation.

Article 14 has applied since 11 September 2026. It requires a manufacturer of a product with digital elements on the EU market to report an actively exploited vulnerability within 24 hours of becoming aware, then a fuller notification at 72 hours, then a final report within 14 days of a fix being available. Under Article 69(3) products already on the market before that date are in scope.

A hit here does not mean you must file. KEV evidences exploitation somewhere in the world. Article 14 asks about exploitation in your product. If the vulnerable code path isn't reachable in your build, the answer may be no. That's a human judgement — this tool finds the shortlist worth making it about. Equally, a clean result is not a certificate: your own telemetry or a customer report can start the clock before CISA lists anything.

Run it properly

This page is the convenient version. The real tool walks your whole repository, handles twelve lockfile formats, runs in CI, and exits non-zero on a match:

cra-watch on GitHub — free, MIT

Run it on a schedule, not just on push. The KEV catalogue gains entries continuously: a repository that was clean yesterday can become a reporting question today without a single line of your code changing.