Observed arrival · 2026-08-31

Cidra ranks the software you actually run

cidra.dev Observed source

Editorial interest 84/100 Selection signal · not a rating of the site

Cidra accepts software inventories, resolves products to CPE or PURL identities, and ranks vulnerabilities using exploitation evidence rather than severity alone.

Landing page captured for the 2026-08-31 issue.

Field notes

Cidra takes an inventory rather than source code: rows from CSV, TSV, CycloneDX, or SPDX are resolved to CPE or PURL identities with an attached confidence value. Its workflow names six supported version schemes and applies VEX and vendor-backport information before prioritising findings with KEV, EPSS, exposure, and asset tier. The page says one resulting record can feed a ticket, evidence pack, and board summary without re-authoring.

Observed signals

Read the marks

Editorial observations of this landing page, not a rating.

○OpenPublic substance visible

$PaidCommerce or pricing visible

✦PrettyNotable craft visible

●ProPolished or operationally mature

◎NicheUnusually specific use

ƒJavaScriptBrowser-side code central

One card from the complete issue

Habitat Reduced to One Settee

219,482 arrived 1,000 judged 999 catalogued Enter the complete issue