  The prevalent usage of open-source software (OSS) has led to an increased
interest in resolving potential third-party security risks by fixing common
vulnerabilities and exposures (CVEs). However, even with automated code
analysis tools in place, security analysts often lack the means to obtain an
overview of vulnerable OSS reuse in large software organizations. In this
design study, we propose VulnEx (Vulnerability Explorer), a tool to audit
entire software development organizations. We introduce three complementary
table-based representations to identify and assess vulnerability exposures due
to OSS, which we designed in collaboration with security analysts. The
presented tool allows examining problematic projects and applications
(repositories), third-party libraries, and vulnerabilities across a software
organization. We show the applicability of our tool through a use case and
preliminary expert feedback.
