CVE and vulnerability lookup
Give Zeplik a package name and version and it checks a live security advisory database for known CVEs, then answers with the real identifiers. Not a confident guess from training data, and never an invented CVE number: each advisory comes back with its actual GHSA or CVE ID, its severity, and the version that fixes it, so you can click through and verify. When it cannot find or confirm a package, it says so plainly instead of making something up.
The lookup is free; you pay only the normal cost of the answer, shown before you send.
How it works
Name the package and version
Ask about a specific dependency in plain language, like 'is express 4.17.1 vulnerable?'. Including the exact version and ecosystem (npm, PyPI, Maven) gives the most precise answer. You do not have to open the tool explicitly; naming a package and asking about vulnerabilities is enough for Zeplik to run the lookup.
Zeplik queries the live database
It looks the package up against a live security advisory database, not the model's training memory, and treats the result as source material. The advisory data is handled as untrusted content, so nothing inside a record can hijack the answer.
Read the grounded result and act
The answer lists each advisory by its real identifier, with severity and the fixed version where known, so you can click through and confirm. Ask follow-ups, compare versions, or check the next dependency, all in the same conversation.
Worked examples
Real prompts you can open in the composer with the text ready to review. Nothing sends on its own. Swap in your own package and version.
Prompt: Are there any known CVEs in lodash 4.17.11 on npm?
Zeplik queries the advisory database for that exact name and version and lists the real GHSA and CVE identifiers, so you can click through to the source rather than trust a guess.
Open this in ZeplikPrompt: Check requests 2.19.1 on PyPI for security advisories and tell me the severity of each
It grounds the answer in what the database actually records: each advisory's ID, severity, and the versions that fix it, not a plausible-sounding invention.
Open this in ZeplikPrompt: Does log4j-core 2.14.1 have any known vulnerabilities I should patch?
For a package with well-known issues, the lookup surfaces the advisories by ID so you can confirm the fix version instead of relying on the model's memory of the incident.
Open this in ZeplikWhat it can and cannot do
The lookup is precise about known, published advisories and honest about its edges. Here is the plain posture.
Give a package name and version and Zeplik returns the advisories recorded for it, each with its real GHSA or CVE identifier.
Common open-source ecosystems are covered, so you can check a JavaScript, Python, or Java dependency the same way.
Where the database records it, the answer includes each advisory's severity and the version that resolves it, so you know what to upgrade to.
If a package or version is not found, or the database has no entry, Zeplik says so plainly instead of inventing a CVE that does not exist.
This looks up one package at a time from what you name. To scan an entire lockfile or repo, run your ecosystem's audit tool (npm audit, pip-audit) and paste the results in for help interpreting them.
It reports what public advisory databases already know. A vulnerability that has not been published anywhere cannot be looked up by anyone, this tool included.
Grounded, and honest by default
- It cites real identifiers. Every advisory comes back with its actual GHSA or CVE number, so you can verify each claim at the source instead of trusting the model's memory.
- It will not invent a CVE. When a package or version cannot be found or confirmed, Zeplik says so rather than fabricating a plausible-looking advisory.
- Advisory data cannot hijack the answer. The database result is treated as untrusted content: Zeplik reads and reports it but never obeys instructions embedded inside it.
Frequently asked questions
- Why not just ask a chatbot if a package is vulnerable?
- Because a language model on its own will often answer confidently from stale or half-remembered training data, and can invent CVE numbers that do not exist. This tool grounds the answer in a live advisory database and cites the real identifiers, so you can verify every claim at its source instead of trusting a guess.
- Which ecosystems and databases does it cover?
- It checks common open-source ecosystems, including npm, PyPI, and Maven, against a live public vulnerability database. Give the package name, the version, and ideally the ecosystem, and Zeplik returns the advisories recorded for that exact release.
- Does the lookup cost credits?
- The lookup itself is free. Querying the advisory database draws nothing from your balance; you only pay the normal model-token cost of the answer Zeplik writes around it, exactly like any other message, and the cost is shown before you send.
- What happens if the package is not found?
- Zeplik tells you plainly that it could not find or verify the package or version, rather than fabricating a result. A clean 'no known advisories' is only reported when the database genuinely returns none for what you named.
- Can it audit my entire project at once?
- Not directly. It looks up one package at a time from what you name. For a whole-project scan, run your ecosystem's audit tool (such as npm audit or pip-audit), then paste the output into the chat and Zeplik will help you triage and prioritize the findings.
- Which AI model does the lookup?
- The database query is a built-in capability that works the same regardless of model. The answer around it is written by whichever of Zeplik's frontier chat models you pick, and you can switch models at any time, including mid-conversation.
Related skills
Go deeper on securing your stack with these ready-to-run Zeplik skills.
More on Zeplik
Know before you ship
Check any dependency for known CVEs, grounded in a live database, with the real advisory IDs. Free to start.