Your files stay on your device

Vulnerability report normalizer

Load Trivy, Grype, or generic CSV and JSON scanner reports, map columns once with a live preview, and get deduplicated findings in one canonical exportable schema.

Drop reports here, open files, or paste one below.

Add a report, then press Normalize reports.

What this normalizer does, and what it does not
It reads Trivy JSON, Grype JSON, generic JSON arrays, and CSV or TSV tables, normalizes severity and status vocabularies, and merges only exact matches: same identifier, same asset, same component version. Same identifier on a different version is listed as a near-duplicate and kept separate; findings without an identifier are never merged. It is not a scanner: it never checks whether a CVE applies to your version range, never fetches advisories, and never resolves version comparisons. Exported CSV cells that start with =, +, -, or @ are prefixed with an apostrophe so spreadsheets cannot run them as formulas.OptionsNormalize reports

More regex & cron tools

- JSON validator (/json/validator)
- JSON formatter (/json/formatter)
- JSON diff (/json/diff)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/vulnerability-report-normalizer
Markdown version: https://nutter.tools/dev/vulnerability-report-normalizer.md
Plain-text version: https://nutter.tools/dev/vulnerability-report-normalizer.txt
Agent index: https://nutter.tools/llms.txt