moneat.io

Know which services a vulnerability affects.

Moneat keeps a bill of materials per service and per release and matches it against public advisories, so a new CVE resolves to a list of affected services and the release that fixes them.

Start freeRead the docs
FormatsCycloneDX, SPDX
Tracked perService and release
AnswersWhere it runs, and since when
CVE-2026-3184 · affected servicescritical · 9.8
checkout-apijson-parse 4.2.1 · direct · production · internet-facingsince 2f91c
payments-workerjson-parse 4.2.1 · transitive · productionsince 9c11a
reporting-batchjson-parse 4.2.1 · transitive · staging onlysince 4d02f
orders-apijson-parse 4.3.0 · patchednot affected

From an advisory to the services that need patching

A new advisory is matched against the inventory you already uploaded. Here is one, from the advisory to the release that clears it.

INC-402 · Checkout latency above SLO
Resolved
14:02:11 → 14:19:44 · 17m 33s
09:12:00
An advisory arrives for a package you use
Matched against every service bill of materials: three affected, one already on a patched version.
Security
09:15:40
Exposure ranked by reachability
Internet-facing production services first and staging last, so the list is worked in order.
Security
11:40:10
Closed when the release says so
The finding clears once a release carrying the patched version is running.
Releases

Track what your services depend on

An inventory your build pipeline produces, matched continuously against advisories and ranked by exposure.

SBOM ingest

Upload CycloneDX or SPDX from your existing build as one step in CI.

cyclonedx · spdx
Dependency inventory

Every package, version and licence across services, with direct and transitive separated.

inventory
Vulnerability matching

Match against public advisories continuously, including packages that were clean when you shipped.

cve
Tracked per release

The inventory follows the release that is running, rather than the default branch.

releases
Container images

Base image layers and OS packages alongside application dependencies, in one list.

images
Alert on severity

Route a critical on a public production service differently from a low on a batch job.

alerting
Licence visibility

The licences you ship under, flagged when a dependency changes terms between releases.

licences

Rank findings by exposure.

Moneat ranks findings using what your telemetry already knows about each service, so the list starts with the services most exposed rather than with the highest CVSS score.

  • Is it in production. Running releases rank ahead of versions nothing is deployed on.
  • Is it exposed. Services taking public traffic rank ahead of internal ones, from the trace graph.
  • Is it in use. Whether the affected package appears in recent traces and profiles.
  • What it takes to fix. The fixed version, and every service that has to move to it.
See alert routes
checkout-api · exposureCVE-2026-3184
Running release
2f91c · since 13:58 yesterday
Traffic
public · 41k req/min
Package path
direct dependency
Seen in profiles
yes · 2.1% CPU
Fixed in
json-parse 4.3.0
Also to move
payments-worker, reporting-batch

Related features

Upload your first SBOM.

Add a CycloneDX or SPDX export to your build, and see your dependency inventory matched against advisories per service and release. Start on the free plan with no card.

Start freeSee pricing