Sunshine - SBOM visualization tool

Analyzed CycloneDX JSON file: sbom-with-vulns.cdx.json

No. of Components	Vulnerabilities	Main Component	Spec Version	Version
101	Critical: 0,  High: 0,  Medium: 1,  Low: 12,  Information: 1, Max EPSS → 0.00552, Vulnerabilities in CISA KEV → 0	Type → application, Name → Apex, Version → master	1.6	1

This chart visualizes components and their dependencies, with each segment representing a single component. The chart provides a hierarchical view of the dependency structure, with relationships radiating outward from the core components.

• Innermost circle: represents components that are independent and not dependencies for any other components.
• Outer circles: each segment represents a dependency of the corresponding segment in the circle immediately inside it. The farther a segment is from the center, the deeper the dependency level.

Note: If there is only one circle, it means that no dependency relationships are defined in the input file.

The colors of the segments indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.
• Grey: neither the component nor its dependencies are affected by any vulnerabilities.

The chart is interactive:

• Hovering: displays details about a component, including its name, version, and list of vulnerabilities.
• Clicking: refocuses the chart. The clicked segment becomes the center (second innermost circle), showing only that component and its dependencies. In this view, the innermost circle is always blue. Clicking the blue circle navigates back up one level in the dependency hierarchy.

---

---

This table visualizes components, their dependencies, vulnerabilities and licenses.
The colors of the elements in columns "Component", "Depends on" and "Dependency of" indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.
• Grey: neither the component nor its dependencies are affected by any vulnerabilities.

The colors of the elements in columns "Direct vulnerabilities" and "Transitive vulnerabilities" indicate the severity of the vulnerabilities:

• Dark red: critical.
• Red: high.
• Orange: medium.
• Yellow:low.
• Green:informational.

---

This table focuses on vulnerabilities and shows the components that are affected either directly or transitively.
The colors of the elements in column "Vulnerability" indicate the severity of the vulnerabilities:

• Dark red: critical.
• Red: high.
• Orange: medium.
• Yellow:low.
• Green:informational.

The colors of the elements in columns "Directly vulnerable components" and "Transitively vulnerable components" indicate the vulnerability status of the components:

• Dark red: affected by at least one critical severity vulnerability.
• Red: affected by at least one high severity vulnerability.
• Orange: affected by at least one medium severity vulnerability.
• Yellow: affected by at least one low severity vulnerability.
• Green: affected by at least one informational severity vulnerability.
• Light blue: not directly affected by vulnerabilities but has at least one vulnerable dependency.

---

Vulnerability	Severity	Score	Vector	EPSS	CISA KEV Date	Directly vulnerable components	Transitively vulnerable components
CVE-2024-38460	Low	4.9	-	0.00104	-	org.sonarsource.sonarqube:sonar-ws 10.0.0.68432	Apex master
CVE-2024-7254	Low	8.7	-	0.00189	-	com.google.protobuf:protobuf-java 3.21.12	Apex master, org.sonarsource.sonarqube:sonar-ws 10.0.0.68432
CVE-2025-48924	Low	6.5	-	0.00309	-	commons-lang:commons-lang 2.6, org.apache.commons:commons-lang3 3.14.0	Apex master, org.sonarsource.slang:slang-testing 1.19.0.6612, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.sonarqube:sonar-plugin-api-impl 10.6.0.92116, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2023-3635	Low	7.5	-	0.00301	-	com.squareup.okio:okio 3.0.0, com.squareup.okio:okio-jvm 3.0.0	Apex master, com.squareup.okhttp3:okhttp 4.10.0, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, com.squareup.okio:okio 3.0.0, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2025-52999	Low	8.7	-	0.00069	-	com.fasterxml.jackson.core:jackson-core 2.13.2	Apex master, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2
CVE-2020-36518	Low	7.5	-	0.0049	-	com.fasterxml.jackson.core:jackson-databind 2.13.2	Apex master, com.fasterxml.jackson:jackson-bom 2.13.2, com.fasterxml.jackson.core:jackson-core 2.13.2, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2022-42003	Low	7.5	-	0.00278	-	com.fasterxml.jackson.core:jackson-databind 2.13.2	Apex master, com.fasterxml.jackson:jackson-bom 2.13.2, com.fasterxml.jackson.core:jackson-core 2.13.2, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2022-42004	Low	7.5	-	0.00239	-	com.fasterxml.jackson.core:jackson-databind 2.13.2	Apex master, com.fasterxml.jackson:jackson-bom 2.13.2, com.fasterxml.jackson.core:jackson-core 2.13.2, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2023-35116	Information	4.7	-	0.00015	-	com.fasterxml.jackson.core:jackson-databind 2.13.2	Apex master, com.fasterxml.jackson:jackson-bom 2.13.2, com.fasterxml.jackson.core:jackson-core 2.13.2, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2022-40152	Medium	7.5	-	0.00552	-	com.fasterxml.woodstox:woodstox-core 6.2.7	Apex master, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, com.fasterxml.jackson.dataformat:jackson-dataformat-xml 2.13.2
CVE-2023-6481	Low	7.5	-	0.00312	-	ch.qos.logback:logback-classic 1.3.12, ch.qos.logback:logback-core 1.3.12	Apex master, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625, ch.qos.logback:logback-classic 1.3.12
CVE-2024-12798	Low	5.9	-	0.00161	-	ch.qos.logback:logback-core 1.3.12, ch.qos.logback:logback-core 1.2.13	Apex master, ch.qos.logback:logback-classic 1.2.13, org.sonarsource.slang:slang-testing 1.19.0.6612, ch.qos.logback:logback-classic 1.3.12, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2024-12801	Low	2.4	-	0.00042	-	ch.qos.logback:logback-core 1.3.12, ch.qos.logback:logback-core 1.2.13	Apex master, ch.qos.logback:logback-classic 1.2.13, org.sonarsource.slang:slang-testing 1.19.0.6612, ch.qos.logback:logback-classic 1.3.12, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625
CVE-2024-47554	Low	4.3	-	0.00213	-	commons-io:commons-io 2.7	Apex master, org.sonarsource.orchestrator:sonar-orchestrator-junit4 5.6.2.2625, org.sonarsource.orchestrator:sonar-orchestrator 5.6.2.2625

Sunshine - SBOM visualization tool | Made by Luca Capacci | Contributor Mattia Fierro | GitHub repository | License