Lots of licensed solutions have this (typically SAST or DAST tooling like Snyk, etc...). Given your build manifest/SBOM they cross-reference CVEs for vulnerabilities during/after build time.
Some have free licenses, many don't.
Some have free licenses, many don't.
Sometimes build time is too slow (e.g., a repo that doesn't receive updates every day or so).