Vulnerable and Outdated Components
Using libraries or components with known vulnerabilities or that are no longer maintained.
What are Vulnerable & Outdated Components?
Modern apps rest on many dependencies: libraries, frameworks, and modules written by other people. If one of them has a known vulnerability (with a CVE number) that isn't patched, the whole application inherits its risk. You didn't write the bug, but you still ship it. Try the scanner in the demo tabs.
Why this slips through
Even a small project can pull in hundreds of indirect dependencies (dependencies of dependencies). A version that's safe today can become vulnerable tomorrow when a new CVE is announced. Without regular scanning, a publicly known vulnerability can sit in your project for months unnoticed.
How to prevent it
Make dependency scanning part of your workflow: use npm audit, Dependabot, or Snyk to watch for CVEs automatically. Update dependencies regularly, remove unused packages, and avoid libraries that are no longer maintained. Pin versions (a lockfile) so builds are consistent and auditable.
Impact
Because the vulnerability is public along with how to exploit it, outdated components are easy targets. Many large-scale attacks start from a single dependency patched too late, ranging from data theft to remote code execution.