Coverage you can see
Every report states the packages, versions, ecosystems, and advisory sources it covered.
Supply chain
Put dependency risk in application context.
Move from package advisories to upgrade decisions your engineers can act on, with the fixed version and the command to get there.
- acme
- /billing-api
- /Dependencies
Packages412
Advisories7
Reachable2
package.jsonnpm
- express4.19.2
- body-parser1.20.2
- axios1.6.0Reachable
- follow-redirects1.15.4
- pdfkit0.13.0
- fontkit2.0.2
- jsonwebtoken9.0.0
AdvisoryHigh
SSRF through a path-relative URL
CVE-2024-39338 · axios
- Version
- 1.6.0 → 1.7.4
- Called from
- webhooks/preview.ts:61
- Upgrade
bun add axios@1.7.4
The problem
An advisory ID is not a remediation plan.
Teams need to know which repository has the package, what OSV reports, whether a fix exists, and how to apply it safely. winfunc answers all four, then rescans to confirm the upgrade worked.
Included
What winfunc covers.
- OSV and CVE advisory coverage
- Inventory from npm, PyPI, Maven, Go, and Cargo artifacts
- Installed-version and affected-range context
- Severity and applicability signals for prioritization
- Fixed-version guidance with upgrade commands
- Scheduled rescans as code and advisories change
Outcomes
What your team walks away with.
Prioritized upgrades
Severity, installed version, and application context decide which advisories need action first.
Concrete remediation
Where a fix exists, you get the exact upgrade path for your package manager.
Continuous watch
Scheduled reviews surface newly disclosed advisories as they affect your dependencies.
Continue the evaluation
Start with one repository
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.