Low Severity
Published: Oct 25, 2026
🛡️ Self-hosted vulnerability scanner — scan websites, IPs & code against 100k+ CVEs (NVD + CISA KEV), live scan logs, SARIF reports, CLI & scheduled scans. Two dependencies, zero cloud.
<div align="center">
# 🛡️ VulnScan
### Your own vulnerability scanner — one `npm start` away.
Scan websites, IPs, source code and dependency files against **100,000+ CVEs**, watch every check run **live**, and ship **SARIF** straight into GitHub Code Scanning.
**Self-hosted. Two dependencies. No cloud account. No data leaves your machine.**
[](https://github.com/bstforom/vulnscan/actions/workflows/ci.yml)
<img src="docs/screenshots/live-scan.png" alt="VulnScan live scan with streaming log and findings" width="900">
</div>
---
## 🤔 Why VulnScan?
Most scanners are either expensive SaaS that wants your targets on *their* servers, or a pile of CLI tools you have to glue together. VulnScan is a single, readable Node.js app you run on your own laptop or server.
| | |
|---|---|
| 🎯 **Accuracy first** | A CVE is only reported when the detected version actually falls inside the vulnerable **CPE range**. Exposed files are confirmed by **content signature**, not just `200 OK` — so catch-all pages don't flood you with false positives. |
| 👀 **Nothing is a black box** | A **live log** streams every phase as it happens: DNS, TLS, WAF detection, fingerprinting, each deep check and its result. |
| 🔥 **Prioritized by real-world risk** | Findings are ranked using **CISA KEV** (actively exploited), optional **EPSS** probability, confidence and CVSS. |
| 🔁 **Fits your pipeline** | Web dashboard, **CLI** with CI-friendly exit codes, **SARIF** for GitHub Code Scanning, and a **JS library API**. |
| ⏱️ **Set it and forget it** | **Sched