Check out Mike Taber's¹ cross-platform work-in-progress: https://www.auditshark.com/

It is targeted more at OS-level vulnerabilities (including IIS) rather than application dependency vulnerabilities, but may provide the solution you're looking for.

¹ https://news.ycombinator.com/item?id=9492839