hevnsnt/CVEngine

What is CVEngine?

CVEngine is a free, open-source tool that continuously watches your internet-facing systems (websites, servers, IPs) and tells you which currently exploited security vulnerabilities actually affect you. It combines three things that are usually separate: asset discovery (finding what you own), vulnerability scanning (checking for weaknesses), and threat intelligence (tracking known exploits). Instead of dumping alerts, it gives you a verdict: "This CVE is live on this host, and here's the evidence."

It's self-hosted — you run it on your own server, and your data stays with you. You can bring your own AI keys (or run a local model) to help triage findings, but the core scanning works without AI.

What does it do?

1. Discovers your assets — You give it a domain name, IP, or CIDR range. It automatically finds subdomains, hosts, open ports, services, versions, TLS certificates, and technologies. It keeps this inventory up to date.

2. Matches CVEs to your environment — It pulls live CVE feeds (like CISA KEV, Exploit-DB, Metasploit) and rates each CVE as fire (actively exploited), smoke (likely exploited), or ice (less urgent). It then matches those CVEs against the exact products and versions it found on your hosts, including Linux distribution backports.

3. Verifies with safe, read-only checks — For each match, it runs non-destructive tests (like a specific nmap probe or a vetted nuclei template) to confirm the vulnerability is real. It records exactly what command it ran. If no test exists, the AI can draft one, but it never runs on your hosts until a human approves it.

4. Prioritizes and explains — Each host gets a 0–100 risk score with reasons. AI triages every finding into categories like confirmed, likely, needs validation, likely false positive, or not applicable. You see the evidence behind each verdict.

5. Tracks changes over time — New hosts, opened ports, version changes, new certificates, and changed web pages appear on a timeline with side-by-side screenshot diffs.

How it works

You add a target (domain, IP, CIDR, URL). CVEngine runs a pipeline:

• FIND — Uses bbot for subdomain/asset discovery, then nmap and naabu to map ports and services.
• PROBE — Checks for exposed databases (Redis, PostgreSQL, etc.), takes screenshots, runs web route checks, and optionally scans WordPress.
• MATCH — Correlates CVEs with your inventory, then runs targeted nuclei scans.
• DECIDE — AI triages and validates findings, then outputs to the dashboard, API, and alerts.

Meanwhile, the CVE feed runs on its own schedule, rating new CVEs and matching them to your inventory.

Key features

• Shodan-style search — Query your inventory like port:3389 -host:vpn or tech:"apache tomcat" sev:high.
• Email and domain hygiene — Checks SPF, DKIM, DMARC, DNSSEC, TLS, etc.
• Bug bounty workbench — Browse HackerOne, Bugcrowd, etc., and scan only in-scope assets (off by default).
• Team and agent support — Organizations, projects, roles, audit log, REST API, MCP server, and OpenAPI spec.
• Alerts — Slack, Discord, Telegram, or Lark notifications.
• Bring your own AI — Anthropic, OpenAI, OpenRouter, Ollama, or vLLM. Without AI, it still discovers, scans, and validates.

Safety by design

• Only read-only checks; no password lists are tried.
• Never scans loopback, link-local, or cloud metadata addresses. Private ranges are off until you allow them.
• Blocks injection attempts and disables accounts after repeated strikes.
• Data isolation per project, encrypted secrets, two-step sign-in, IP allowlist, audit log.

Getting started

On a Linux server (Debian/Ubuntu easiest, 4–8 GB RAM, 20 GB disk):

git clone https://github.com/hevnsnt/CVEngine.git
cd CVEngine
sudo ./install.sh

The installer generates everything, creates an HTTPS certificate, and prints your address, username, and a one-time password. You set your own password on first login. The setup wizard guides you through creating an organization, adding a target (you must confirm you're authorized to test it), and optionally connecting an AI model.

License and credits

GPL-3.0. It's a fork of reNgine 2.x and builds on many open-source tools (nmap, nuclei, bbot, etc.). Full credits in THIRD-PARTY.md.

---

Bottom line: CVEngine is a self-hosted, free attack surface management platform that finds your internet-facing assets, matches them against known exploited CVEs, verifies with safe checks, and gives you a prioritized, evidence-backed list of what to fix — all without per-asset fees or sending your data anywhere.