Low Severity
Published: Nov 12, 2026
A to-do list for your Ubuntu server instead of a CVE list. Claude Code plugin: KEV/EPSS, real exposure, containers, pending reboots.
# cve-delta
[](https://github.com/onur-yuksekkaya/cve-delta/actions/workflows/tests.yml)
[](CHANGELOG.md)
[](LICENSE)
**A to-do list for your Ubuntu server, instead of a CVE list.**
cve-delta is a Claude Code plugin. Type `/cve-delta:scan myserver` and Claude scans the server over SSH,
works out which of its thousands of known CVEs actually matter there, checks the urgent ones on the server
itself, and hands you a short list of what to do, in order, with the exact commands.
<sub>Example with invented data. Here's [a full example report](docs/example-report.md).</sub>
## Why
Run a CVE scanner on a typical VPS and you get thousands of findings. Almost none of them need anything
from you today: most have no patch yet, sit in code that isn't running, or are already fixed by an update
that's waiting for a reboot. Meanwhile the problems that really bite self-hosters don't show up as CVEs at
all: a database Docker quietly opened to the internet past your firewall, a kernel patched on disk but
never rebooted into, a certificate that has been failing to renew for months.
cve-delta answers one question: **what should I do on this server this week?**
## What it finds
- **CVEs that matter here.** Actively exploited ones (CISA KEV) and likely ones (EPSS), but only where the
vulnerable code is actually loaded by a running process, listening publicly, or in a kernel module
that's active. Matching uses your distribution's own fixed versions, so backported fixes count as fixed.
- **Patches waiting for a reboot** and services still running replaced libraries.
- **Containers.** OS and npm packages in every running image, runtimes past end of life, containers
with the Docker socket mounted or running privile