hevnsnt/CVEngine

The most advanced external attack surface assessment you can get for free.

Type in your domain. cvENGINE finds everything you expose, then tells you which of today's exploited CVEs can actually hit you, with proof.
No license fee. No per-asset pricing. No black box. 100% open source and self-hosted.

---

Know what you expose. Fix what's exploitable first.

Attack surface tools find assets. Vulnerability scanners find flaws. Threat feeds find CVEs. cvENGINE runs all three as one continuous loop and hands you a verdict instead of a pile of alerts. It answers the question that matters: of everything exploited today, what do I have exposed?

• Total visibility. Domains, subdomains, IPs, ports, products, versions, TLS, and technologies, discovered for you and kept current in one Shodan-style inventory.
• Exploitation-ranked. Every CVE is rated fire, smoke, or ice from the real exploitation sources, then matched to what you actually run.
• Proof, not noise. AI triage plus read-only checks that reproduce the finding, with the exact command recorded.
• Nothing changes unseen. New hosts, opened ports, version bumps, and changed front pages land on a timeline.
• Yours completely. One Docker Compose stack on your own server. Bring your own AI keys, or run a local model.

Everything in the box

| | | | --- | --- | | Discover | Subdomains, certificates, IPs, and ports with bbot and naabu, plus a certificate transparency watch and weekly deep sweeps | | Understand | nmap service and OS fingerprints, web routes and their sign-in state, exposed databases, firewalls, WordPress, and email and DNS hygiene | | Prioritize | Fire, smoke, and ice ratings, a 0 to 100 score per host, and AI triage into confirmed, likely, or needs validation | | Verify | Read-only validation with Nuclei, nmap, and banner probes. Validate now on any match | | Search | Shodan-style search over your own inventory: port:3389 -host:vpn, tech:"apache tomcat" sev:high | | Operate | A live dashboard, a change timeline with screenshot diffs, organizations and roles, two-step sign-in, a REST API, an MCP server, and Slack, Discord, Telegram, and Lark alerts | | Hunt | A bug bounty workbench: program scope from HackerOne, Bugcrowd, Intigriti, and YesWeHack, and report drafts | | Bring your own AI | Anthropic, OpenAI, OpenRouter, Ollama, or vLLM. Without a model it still discovers, scans, matches, and validates |

New in 1.2

• Every CVE says how to prove it. A shared detection strategy and validation profile for the whole catalog, readable through the API and MCP.
• A full CVE catalog on day one. New installs download a verified catalog on first start instead of rebuilding it one request at a time.
• It names the firewall in front of every host, with wafw00f.
• It never sits idle. A work conductor keeps discovery running across a thousand hosts.
• One host, many names. example.com and www.example.com on the same servers are one host.
• Every Nuclei template, if you choose. A switch in Settings runs the whole library (off by default).
• Updates in seconds, with a CI upgrade rehearsal before every release (updates).
• Hardened. A Redis password, a rotatable key for stored secrets, hashed sessions, a sign-in throttle, and an encrypted CA key. Older installs: see upgrading to 1.2.

How it works

flowchart LR
    T(["Add a target
domain, IP, CIDR, URL"])
subgraph FIND["1   FIND"]
        direction TB
        D["Discovery
bbot"] --> I["Inventory
nmap, naabu"]
    end
subgraph PROBE["2   PROBE"]
        direction TB
        X["Exposure checks
databases, RDP screenshot"] --> N1["nuclei
technology pass"] --> R["Firewall and web
route checks"] --> W["WPScan
node2shell, opt-in"]
    end
subgraph MATCH["3   MATCH"]
        direction TB
        C["CVE correlation"] --> N2["nuclei
AI-targeted pass"]
    end
subgraph DECIDE["4   DECIDE"]
        direction TB
        A["AI triage
and validation"] --> O["Changes, host score,
dashboard, API, alerts"]
    end
H["Hygiene
TLS, SPF, DKIM, DMARC, CAA"]
T --> FIND --> PROBE --> MATCH --> DECIDE
    DECIDE -.-> H
style FIND fill:#e8f1ff,stroke:#3b82f6,color:#0b3b8c
    style PROBE fill:#f1eaff,stroke:#8b5cf6,color:#3b1d8c
    style MATCH fill:#fff4e0,stroke:#f59e0b,color:#7a4a00
    style DECIDE fill:#e6f7ec,stroke:#22c55e,color:#0b5a2a
    linkStyle default stroke:#555,stroke-width:2px
classDef start fill:#111,stroke:#111,color:#fff
    classDef step fill:#fff,stroke:#444,color:#111
    classDef out fill:#fff,stroke:#16a34a,stroke-width:2px,color:#111
    class T start
    class D,I,X,N1,R,W,C,N2,A step
    class O out
    class H step

Each scanner runs once per host inside a time window, so repeat scans stay fast. See the pipeline for every stage.

Built on the best

cvENGINE stands on excellent open source work. Full credits and licenses are in THIRD-PARTY.md.

| | | | --- | --- | | Scanners | bbot, Nuclei and its templates, naabu, nmap, gowitness, wafw00f, WPScan, aardwolf, node2shell | | Exploitation intelligence | cve.now, CISA KEV, ENISA EUVD, FIRST EPSS, Exploit-DB, Metasploit, VulnCheck KEV, CVE List V5 | | Also | OSV, Debian security tracker, crt.sh, MailFail, bounty-targets-data, Bugcrowd VRT, Ollama, vLLM, Model Context Protocol |

Install in minutes

On a Linux server (Debian or Ubuntu is easiest, with 4 GB of RAM or more):

git clone https://github.com/hevnsnt/CVEngine.git
cd CVEngine
sudo ./install.sh

It asks nothing: it installs what is missing, generates every secret, creates the HTTPS certificate, starts cvENGINE, and prints the address and your admin password. Open the address, sign in, and add a domain. The setup wizard does the rest. Your browser will warn about the private certificate until you trust secrets/certs/ca.crt.

Step-by-step install, a public name with a trusted certificate, and Mac and Windows are in Deployment and Hosting online.

Safe by design

Read-only checks, no password lists, and no scanning of loopback, link-local, or cloud metadata addresses. Each organization's data is isolated, stored secrets are encrypted, and access is protected by two-step sign-in, an IP allowlist, and an audit log. Only scan systems you own or are authorized to test.

Documentation

| Doc | What it covers | | --- | --- | | Deployment and Hosting online | Install, HTTPS, proxies, backups, dev stack | | Updates and Upgrade | Staying current | | Configuration | Every setting | | Search | Shodan-style search, with examples | | Fire, smoke, and ice | How CVEs are rated and why | | Pipeline and Architecture | How it works | | Compare | cvENGINE and ProjectDiscovery, feature by feature | | Tenancy, Agent API, AI usage | Teams, the REST API and MCP, and AI cost | | Bug bounty and Front end | The bounty workbench and the interface |

Credits and license

cvENGINE is a fork of reNgine 2.x by Yogesh Ojha and its contributors, and builds on the projects above. See the changelog, contributors, and third-party software.

Released under the GPL-3.0. See LICENSE.