CVEngine

Free, self-hosted attack-surface platform that discovers everything a domain exposes, matches exploited CVEs against what it actually runs, and triages each finding with AI plus read-only validation.

Open Source Security
Visit Website ↗ by CVEngine

What is CVEngine?

CVEngine discovers everything a domain exposes to the internet, then matches exploited CVEs against what the domain actually runs — so you triage real exposure, not every theoretical CVE.

It is free and self-hosted under GPL-3.0, runs in Docker, and triages each finding with AI plus read-only validation — for systems you own or are authorised to test.

Key features

  • Internet-exposure discovery for everything a domain puts online
  • Exploited-CVE matching against the stack the domain actually runs
  • AI triage with read-only validation of each finding
  • Docker deployment on your own infrastructure
  • Free and self-hosted under GPL-3.0

Pros

  • Free and self-hosted — no subscription, your data stays on your infrastructure
  • Focuses on exploited CVEs, not every theoretical vulnerability
  • Read-only validation avoids touching the systems being tested
  • Docker install keeps setup simple

Cons

  • Only for systems you own or are authorised to test
  • You run the infrastructure — a Linux server with 4 GB of RAM or more is recommended

CVEngine at a glance

PricingOpen Source
CategorySecurity
Platformsmac, windows, linux
CompanyCVEngine
Best forSecurity teams and owners who want to find and prioritise their own internet-exposed weaknesses
Official websitegithub.com
attack surfacecvevulnerability scanningself-hostedsecurity

How to choose the right Security tool

Security tools protect accounts, devices and data, so the first question is what exactly is being protected — passwords, browsing, files, identity or a whole network — and against which threats. Prefer tools from established vendors with transparent practices: independent audits, clear data policies and a record of fixing vulnerabilities quickly matter more than long feature lists. Check how the tool balances protection with friction; security you disable because it annoys you protects nothing. For password and identity tools, strong encryption and zero-knowledge design are the standards to look for. Finally, remember that no tool replaces basic hygiene — unique passwords, two-factor authentication and regular updates do most of the protective work, and a good tool makes all three easier.

Compare all Security tools →

CVEngine FAQs

What is CVEngine?

CVEngine discovers everything a domain exposes to the internet, then matches exploited CVEs against what the domain actually runs — so you triage real exposure, not every theoretical CVE.

What are the main features of CVEngine?

CVEngine offers Internet-exposure discovery for everything a domain puts online, Exploited-CVE matching against the stack the domain actually runs, AI triage with read-only validation of each finding, Docker deployment on your own infrastructure and Free and self-hosted under GPL-3.0.

How much does CVEngine cost?

CVEngine is open source, so the software itself is free to download, use and self-host. Your only costs are the infrastructure you run it on and any paid services you connect to it.

What are the pros and cons of CVEngine?

Strengths of CVEngine include Free and self-hosted — no subscription, your data stays on your infrastructure; Focuses on exploited CVEs, not every theoretical vulnerability; Read-only validation avoids touching the systems being tested. On the downside, Only for systems you own or are authorised to test; You run the infrastructure — a Linux server with 4 GB of RAM or more is recommended.