OSS + ELC EU 2026

With embedded devices now everywhere, from home appliances to industrial systems, it is vital to regularly scan them so that any known vulnerability (CVE) in software components can be identified and addressed before they become security risks.

Regularly monitoring these CVEs will be mandatory in various cases to comply with the EU Cyber Resilience Act (CRA), which pushes the industry towards more accountable and proactive security in embedded systems.

Released in December 2025, sbom-cve-check is an open-source automated vulnerability analysis tool. It operates directly on a Software Bill of Materials (SBOM), without requiring access to the original build environment. SBOMs can be generated from build systems such as Yocto, enabling post-build security analysis even when the build infrastructure is unavailable.

This talk will present sbom-cve-check, highlight its major improvements over the past six months, and explain how it is now fully integrated into Yocto, replacing the built-in cve-check class.

sbom-cve-check is provided under the GPLv2 license, and contributions are, of course, welcome :)