Vuls

No entries match these filters. Clear filters

1. v0.42.0 Oct 15, 2026 · issue 109

   Vuls v0.42.0 adds Windows 11 26H2 scanning support and expands Fortinet CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. coverage with three new RangeType values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.42.0 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.42.0

   • Expands Fortinet CSAF vulnerability data with three new RangeType values: fortinet-fortisiem_cloud, fortinet-fortimonitoronsight, and fortinet-fortipam_chrome_extension.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. v0.41.0 Sep 30, 2026 · issue 090

   Vuls: Passes through Trivy's repository class to models.Package in the contrib/trivy integration.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.41.0 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.41.0

   • Reports NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and VulnCheck CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores per source rather than collapsing them into a single score — NVD's own analysis and the CNACNACVE Numbering Authority — an organization authorized by MITRE to assign CVE IDs within a defined scope, letting cyber tools reference vulnerabilities under a globally consistent identifier.'s metrics are now both preserved and labelled via Optional['source'].

   1 more in Everything

3. v0.41.0-rc.2 Prerelease Sep 29, 2026 · issue 089

   Vuls v0.41.0-rc.2 adds Oracle Solaris, Apple security releases, and OpenSSH advisory detection via vuls2⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.41.0-rc.2 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.41.0-rc.2

   • Detects vulnerabilities in the Oracle Solaris family through the vuls2 detection engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Detects Apple security releases through the vuls2 detection engine.
   • Detects OpenSSH security advisories through the vuls2 detection engine.

   3 details in Everything

4. v0.40.0-rc.1 Prerelease Jul 29, 2026 · issue 029

   Vuls v0.40.0-rc.1 migrates NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., Cisco, JVN, VulnCheck, Fortinet, Palo Alto, and CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. detection to the vuls2 engine, adds ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. and Seal Security coverage.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.40.0-rc.1 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.40.0-rc.1

   • Routes NVD CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. detection and enrichment through the vuls2 engine with cpematch-expanded criteria, replacing go-cve-dictionary's version-range-only matching.
   • Routes Cisco, Fortinet, Palo Alto, VulnCheck, and JVN data sources through vuls2 for detection and enrichment.
   • Adds ENISA EUVD (European Union Vulnerability Database) as a vuls2 enrich data source.
   • Replaces go-cti with vuls2 attack/CAPEC/CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. datasources; adds ScanResult-level CWEDict, CAPECDict, and ATTACKDict catalog maps and a per-VulnInfo CTIs reference list.
   • Enriches MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. CVE v5 data via the vuls2 pipeline.

   +4 more show less

   • Ignores rejected and withdrawn CPE vulnerabilities to reduce false positives.
   • Surfaces evaluation warnings from the vuls2 detector for improved scan transparency.
   • Uses JPCERT-AT reference_titles as JVN alert titles for more descriptive reporting.
   • Shares a single vuls2 DB session across detect and enrich phases per server, reducing I/O overhead.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The [cti] config section is removed; CTI data is now sourced from vuls2 rather than go-cti.
   • !The per-VulnInfo field previously named Ctis is renamed to CTIs; consumers of scan result JSON will need to update field references.
   • !EUVD content is no longer sourced from go-cve-dictionary; it is now provided solely through the vuls2 enrich path.
5. v0.39.3 Jun 9, 2026 · release notes

   Vuls v0.39.3 adds EOL data for new OS versions and enables Windows vulnerability detection via vuls2.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.39.3 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.39.3

   • Supports Windows vulnerability detection using the vuls2 detector engine.
   • Updates GetEOL with newly released OS versions for accurate end-of-life tracking.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The vuls2-based Windows detector (detect windows with vuls2) changes detection behaviour for Windows targets — existing Windows scan workflows may produce different results on upgrade.
   • !AnalyzeLibrary failures are now treated as warnings instead of errors, which may change pipeline exit codes or alerting behaviour that relied on hard failures.
6. v0.39.3 Jun 9, 2026 · issue 007

   Vuls v0.39.3 switches Windows CVE detection to the vuls2 backend and expands EOL coverage for new OS versions.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.39.3 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.39.3

   • Switches Windows KB-based CVE detection from gost to the vuls2 backend, now reading vuls.db built from microsoft-* sources (breaking change: gost is no longer used for Windows; a vuls.db containing microsoft-* data is required).
   • Surfaces MSRC Exploit Status under CveContent.Optional["exploit"] for Windows detections, maintaining parity with the previous gost output.
   • Adds EOL data for newly released OS versions via updated GetEOL configuration.

   3 details in Everything

7. v0.39.2 May 20, 2026 · release notes

   Vuls v0.39.2 adds disablerepo option support for yum/dnf scanners.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.39.2 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.39.2

   • Supports disablerepo option for yum/dnf package scanning, allowing specific repositories to be excluded during vulnerability detection.

   1 detail in Everything

8. v0.39.0 May 12, 2026 · release notes

   Vuls v0.39.0 adds pylock.toml (PEP 751PEP 751A draft Python packaging standard that defines a lock file format for recording exact dependency versions, giving cyber tools a reproducible, machine-readable way to pin their dependency trees.) detection, Ubuntu 26.04 support, RedHat CVE mitigations, and consolidates exploit/KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./MSF data under vuls2.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.39.0 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.39.0

   • Adds pylock.toml (PEP 751) lockfile detection for Python dependency scanning.
   • Adds Ubuntu 26.04 as a supported OS target.
   • Surfaces RedHat CVE Mitigation data into VulnInfo via the vuls2 detector.
   • Adds a DataSources filter to the enrich function, letting users control which data sources are applied during enrichment.
   • Replaces go-exploitdb, go-msfdb, and go-kev backends with the vuls2 detector for exploit, Metasploit, and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. data.

   +3 more show less

   • Replaces gost RedHat CVE filling with the vuls2 detector.
   • Detects Debian vulnerabilities via the vuls2 detector.
   • Adds Dependency.PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. field (replacing GraphQL-based GitHub detection).

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The go-exploitdb backend is replaced by vuls2; configurations relying on go-exploitdb will no longer function.
   • !The go-msfdb backend is replaced by vuls2; configurations relying on go-msfdb will no longer function.
   • !The go-kev backend is replaced by vuls2; configurations relying on go-kev will no longer function.
   • !The gost RedHat CVE filling path is replaced by vuls2; configurations relying on gost for RedHat will no longer function.
   • !Debian detection now uses vuls2; existing setups using the previous Debian detector will need to migrate to vuls2.
   • !The fvuls Docker image is temporarily removed from Docker Hub publish; pipelines pulling that image will fail.
   • !GraphQL-based GitHub detection is removed; integrations depending on it must migrate to the new Dependency.PURL approach.
9. v0.38.6 Mar 11, 2026 · release notes

   Vuls v0.38.6 adds Amazon Linux vulnerability detection via the vuls2 detector engine.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.38.6 https://github.com/future-architect/vuls.git
   # already have the repo? check out this version:
   $ git checkout v0.38.6

10. v0.38.1 Feb 20, 2026 · release notes

    Vuls v0.38.1 updates OS end-of-life data for more accurate EOL detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.38.1

    • Updates end-of-life (EOL) dates for tracked operating systems, improving accuracy of EOL-based risk reporting.

    1 detail in Everything

11. v0.38.0 Feb 13, 2026 · release notes

    Vuls v0.38.0 adds dev-dependency flagging, Windows vendor fields, updated CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. Top 25 lists, and lowers VulnCheck confidence.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    • Adds dev flag to library scanning so development dependencies are tracked and reported separately from production packages.
    • Adds Dev flag to trivy-to-vuls library conversion, surfacing dev dependencies when importing Trivy results.
    • Adds vendor field for Windows packages in the scanner, enriching package metadata for Windows targets.
    • Includes CWE Top 25 lists for 2023, 2024, and 2025, keeping weakness classifications current.
    • Lowers the confidence level assigned to VulnCheck detections in the detector pipeline.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !VulnCheck detections are now assigned a lower confidence level by the detector; existing workflows that threshold or filter on VulnCheck confidence scores may produce different results after upgrade.
12. v0.37.0 Dec 9, 2025 · release notes

    Vuls v0.37.0 adds support for the EU Vulnerability Database (EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories.) as a detection source.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.37.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

13. v0.36.3 Dec 1, 2025 · release notes

    Vuls v0.36.3 adds Windows 11 25H2 scanning support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.36.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.36.3

14. v0.35.0 Sep 25, 2025 · release notes

    Vuls v0.35.0 adds Fedora detection via vuls2, snmp2cpe timeout/retry options, and vuls2 DB digest tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.35.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    • Adds Fedora vulnerability detection powered by the vuls2 detector engine.
    • Adds --timeout and --retry options to the contrib/snmp2cpe command for more resilient SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale.-to-CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. conversion.
    • Updates the snmp2cpe convert command with new conversion logic.
    • Saves and tracks the digest of the vuls2 vulnerability database for integrity verification.
    • Updates Windows scanner release info fetching.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fedora detection now uses the vuls2 detector (feat! commit a6bee18); setups relying on the previous Fedora detection path may behave differently on upgrade.
15. v0.34.0 Sep 6, 2025 · release notes

    Vuls v0.34.0 adds VulnCheck support, ExploitDB verified field, and base64-encoded lockfile exchange

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.34.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    • Adds verified field to ExploitDB detections, surfacing exploit verification status in results.
    • Supports VulnCheck as a data source via go-cve-dictionary integration.
    • Enables base64-encoded content exchange for lockfile scanning, broadening transport compatibility.

    3 details in Everything

16. v0.33.3 Aug 21, 2025 · release notes

    Vuls v0.33.3 adds EOL tracking for more OSes, Debian 13 (Trixie) GOST support, and Ubuntu detection via vuls2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.33.3

    • Adds EOL date tracking for additional operating systems.
    • Supports Debian 13 (Trixie) in the GOST vulnerability data source.
    • Enables Ubuntu vulnerability detection using the vuls2 detector.

    3 details in Everything

17. v0.33.1 Jun 25, 2025 · release notes

    Vuls v0.33.1 strips image tags from server names when scanning containers with Trivy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.33.1

    • Removes image tag from server name automatically when scanning container images via the Trivy contrib integration, producing cleaner server identifiers.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !When scanning with the Trivy integration, the server name no longer includes the image tag — any pipeline, report, or downstream tooling that matched on the tag-suffixed server name will need to be updated.
18. v0.33.0 Jun 24, 2025 · release notes

    Vuls v0.33.0 adds Ubuntu 25.04, Palo Alto/Cisco CVE detection, Oracle/Alpine vuls2 detection, and ignore-vulnerability patterns.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    • Adds Ubuntu 25.04 (Plucky) as a supported scan target.
    • Adds CVE detection support for Palo Alto and Cisco devices.
    • Detects Oracle Linux and Alpine Linux vulnerabilities via the vuls2 engine.
    • Adds ignore vulnerability pattern support in the vuls2 detector.
    • Adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 end-of-life data to OS metadata.

    +3 more show less

    • Adds row separators to --format-list report output for improved readability.
    • Auto-downloads the vuls2 database when schema versions differ, removing manual intervention.
    • Opens the vulnerability database before the server starts, reducing first-request latency.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Oracle Linux and Alpine Linux now use the vuls2 detection engine (feat!(detector): detect oracle and alpine with vuls2), which may require a compatible vuls2 database and could change detection results on upgrade.
19. v0.30.0 Mar 18, 2025 · release notes

    Vuls v0.30.0 adds Python uv and Poetry v2 lockfile scanning support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.30.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.30.0

    • Supports Python uv and Poetry v2 lockfile formats for dependency vulnerability scanning.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Bumped vuls dictionary libs (feat! bump) — existing dictionary databases may require re-fetching or migration to remain compatible.
20. v0.29.0 Feb 5, 2025 · release notes

    Vuls v0.29.0 adds vuls2 detection engine for RedHat, CentOS, AlmaLinux, and Rocky Linux, plus version info in library findings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.29.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.29.0

    • Enables the vuls2 detection engine for RedHat, CentOS, AlmaLinux, and Rocky Linux vulnerability detection.
    • Adds version information to library fixed-in entries in the trivy-to-vuls contrib converter.
    • Adds library package version data to vulnerability results.

    3 details in Everything

21. v0.28.1 Dec 18, 2024 · release notes

    Vuls v0.28.1 updates end-of-life date tracking for OS platforms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.28.1

    • Updates end-of-life (EOL) data for tracked operating systems, keeping lifecycle-based risk assessments current.

    1 detail in Everything

22. v0.28.0 Dec 8, 2024 · release notes

    Vuls v0.28.0 adds Windows Server 2025 support, Ubuntu 24.10, a custom SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. port option, and RPM source-package tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

    • Adds --port/-P option to contrib/snmp2cpe for targeting SNMP devices on non-default ports.
    • Supports scanning Windows 11 24H2.
    • Supports scanning Windows Server 2025 and Windows Server 2022 23H2.
    • Adds Ubuntu 24.10 (Oracular) as a supported scan target.
    • Changes RPM query format to include sourcerpm, enabling source-package attribution in scan results.

    +1 more show less

    • Skips SSH configuration validation when ssh-keyscan or ssh-keygen fails, improving scanner resilience.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The RPM scanner query format has changed to add sourcerpm; existing scan results or integrations parsing the raw RPM query output may receive differently structured data.
23. v0.27.0 Oct 9, 2024 · release notes

    Vuls v0.27.0 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 scoring, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. CVE source, VulnCheck KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data, and Azure Trivy content type.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.27.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    • Supports CVSS v4.0 scores from NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and Trivy sources.
    • Adds MITRE as a new CVE content source via go-cve-dictionary.
    • Adds VulnCheck KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data to the vulnerability model.
    • Adds new trivy:azure CVE content type for Azure-specific Trivy findings.
    • Skips TDC vs. non-TDC package comparisons in SUSE OVAL detection to reduce false positives.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Alpine detection now uses source packages instead of binary packages (fix!(alpine): use source package for detection) — existing Alpine scan results may change on upgrade.
    • !VulnCheck KEV fields are added to the models (feat!(models): add vulncheck kev) — downstream consumers parsing Vuls output JSON may need to handle the new fields.
24. v0.26.0 Jun 24, 2024 · release notes

    Vuls v0.26.0 adds Minio S3 reporter support and extends EOL data for Alpine 3.19/3.20

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    • reporter/s3 now supports Minio as a storage backend for vulnerability reports

    1 detail in Everything

25. v0.25.4 May 21, 2024 · release notes

    Vulnerability scan results now include modularity labels for Red Hat-like OSes and vendor-specific CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. data in CVE entries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.25.4

    • Adds modularityLabel field to package objects in scan results for Red Hat-like operating systems
    • Adds vendorSeverity and full CVSS vector strings to each object in the cveContents array

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The enabledDnfModules element is removed from scanner JSON results; use packages[].modularityLabel instead.
    • !In cveContents derived from Trivy, the type field value changes from trivy to trivy:nvd, trivy:ghsa, or similar.
26. v0.25.3 May 10, 2024 · release notes

    Adds Ubuntu 24.04 detection support and --tls-insecure-smtp CLI flag for SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. notifications

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.25.3

    └──▷ USE IT
    Send SMTP alerts even when the mail server uses a self-signed or invalid certificate.
    shell copy

    vuls report --config=config.toml --tls-insecure-smtp

    • Adds --tls-insecure-smtp CLI argument to skip TLS certificate verification for SMTP notifications
    • Adds Ubuntu 24.04 (Noble) as a supported distribution for vulnerability detection

    2 details in Everything

27. v0.25.2 Mar 22, 2024 · release notes

    Adds WPScan enterprise feature support to scan results; fixes JAR name/version overwrite and Amazon Linux 2023 EOL detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.2 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.25.2

    • Includes some enterprise features of WPScan in scan results via wpscan detector/library code
    • Updates JAR-like files' Name/Version in the library list at vuls report phase using Java DB

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Names and Versions of JAR-like files set during vuls scan may now be incorrect or insufficient; they are overwritten at the vuls result phase.
28. v0.25.1 Mar 11, 2024 · release notes

    Vuls v0.25.1 adds PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. to scan results and expands lockfile scanning via Trivy update.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.25.1

    • vuls scan results now include a PURL (Package URLPackage URLA standardized string format for uniquely identifying software packages across ecosystems (npm, PyPI, Maven, etc.), letting cyber tools reference and correlate dependency data without ecosystem-specific logic.) field for library scan findings

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !vuls report now receives scan logic previously executed in vuls scan for JAR-like lockfiles; mixing new vuls scan with older vuls report binaries may cause missing vulnerabilities
    • !Vuls outputs results even when all scans fail (previously it output nothing)
29. v0.24.7 Dec 15, 2023 · release notes

    Vuls v0.24.7 adds FreeBSD 14 EOL support and groups NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. data by source

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.7 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.24.7

    • Adds FreeBSD 14 EOL detection capability

    1 detail in Everything

30. v0.24.5 Nov 20, 2023 · release notes

    Vuls v0.24.5 adds support for Fedora 39 and Windows 11 23H2 scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.5 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.24.5

    • Adds fedora 39 to the list of supported operating systems for vulnerability scanning
    • Adds Windows 11 23H2 to the list of supported operating systems for vulnerability scanning

    2 details in Everything

31. v0.24.4 Oct 20, 2023 · release notes

    Vuls v0.24.4 adds Ubuntu 23.10 (Mantic) support for vulnerability scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.24.4

    • feat(ubuntu) adds Ubuntu 23.10 (mantic) to the supported list of operating systems.

    1 detail in Everything

32. v0.24.0 Sep 25, 2023 · release notes

    Vuls v0.24.0 adds macOS detection support and Fortinet CVE data feed integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    • Adds macOS support for vulnerability scanning on Apple operating systems
    • Enables ingestion of the fortinet CVE data feed via the detector engine

    2 details in Everything

33. v0.23.4 Sep 22, 2023 · release notes

    Vuls v0.23.4 adds SNMP2CPE contributions, Windows config auto-upgrade, and KV detection export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.23.4

    • contrib/snmp2cpe now includes additional Fortinet products in its CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. mapping data.
    • config auto-upgrades legacy v1 windows/config.toml files to the v2 schema automatically on load.
    • contrib/fvuls gains new subcommands for retrieving network device CPE information via snmp2cpe and uploading it to the Fvuls server.
    • windows detection now exposes the DetectKBsFromKernelVersion function for external usage.

    4 details in Everything

34. v0.23.3 Jul 10, 2023 · release notes

    Vuls v0.23.3 adds support for Debian 12 and Ubuntu 14.04/16.04 ESM detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.23.3

    • feat(os): support debian 12
    • feat(ubuntu): Support Ubuntu 14.04 and 16.04 ESM

    2 details in Everything

35. v0.23.2 May 10, 2023 · release notes

    Adds Ubuntu 23.04 detection support and removes CGO dependency for dictionary tools.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.2 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.23.2

    • Adds Ubuntu 23.04 platform support to the scanner engine
    • Removes CGO requirement, making dictionary tooling fully portable Go binaries

    2 details in Everything

36. v0.23.0 Apr 6, 2023 · release notes

    Vuls v0.23.0 adds snmp2cpe utility, Windows CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. mapping via CI, and no-sudo csh scanning support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    • Adds the snmp2cpe subcommand in the contrib directory to map SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. OIDs to CPE names
    • Enables Windows CPE detection in the CI pipeline (snmp2cpe integration)
    • Supports csh shell scanning without requiring sudo privileges

    3 details in Everything

37. v0.22.1 Mar 1, 2023 · release notes

    Vuls v0.22.1 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. data to categories and views, updates EOL definitions, refreshes ExploitDB sources, enhances GitHub Alerts integration with dependency details, fixes SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. upload error handling, and improves Ubuntu kernel detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.22.1

    • Adds cwe-id for category and view in reports
    • Updates EOL (End of Life) definitions for supported distributions
    • Mod updates ExploitDB sources and adds more URLs
    • Includes dependencies into scan result and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. for supply chain security on Integration with GitHub Security Alerts
    • Uploads JSON report to SaaS even if an error occurred during the scan

    5 details in Everything

38. v0.23.0-beta Prerelease Feb 23, 2023 · release notes

    Vuls v0.23.0-beta adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-ID support in categories and views, and updates exploitdb detector with new URLs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0-beta https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0-beta

    └──▷ USE IT
    Check if a specific CVE includes CWE classification data in the report output.
    shell copy

    vuls report -format-json | jq '.cves[] | select(.cveId == "CVE-2023-1234") | .cweId'

    • Adds cwe-id field to category and view output structures for vulnerability reports
    • Updates the ExploitDB detection engine (detector/exploitdb) with additional external URLs for more complete threat intelligence coverage

    2 details in Everything

39. v0.21.0 Nov 1, 2022 · release notes

    Vuls v0.21.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. report format support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    └──▷ USE IT
    Generate a CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-style report for integration with downstream supply chain tools.
    shell copy

    vuls report --cyclonedx -o report.cdx.json

    • Adds --cyclonedx flag to enable CycloneDX output format for vulnerability reports

    1 detail in Everything

40. v0.20.0 Aug 8, 2022 · release notes

    Vuls v0.20.0 adds Amazon Linux 2 Extra repo support and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-2022 database.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Supports scanning for vulnerabilities in the Amazon Linux 2 Extra Repository
    • Includes the CWE Top 25 2022 list for vulnerability classification

    2 details in Everything

41. v0.19.8 Jul 4, 2022 · release notes

    Vuls v0.19.8 adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tagging via env vars, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. config support, and new platform detections.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.8 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.8

    • vuls scan now passes VULS_TAGS environment variable values to the SaaS report destination
    • config.toml gains a new cidr field in the server block for network-based target selection
    • Adds detection engine coverage for Alpine Linux 3.16, RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9, CentOS Stream 9, and Alma Linux 9
    • Integrates Cyber Threat Intelligence (CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context.) information into scan results

    4 details in Everything

42. v0.19.6 Apr 27, 2022 · release notes

    Adds text/plain scan support for SUSE servers and OS version parsing from Trivy scans in v0.19.6

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.6 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.6

    • Adds support for server scanning on SUSE systems using the text/plain output format to extend coverage beyond standard package managers.
    • Introduces capability to parse the OS version directly from the result of a Trivy scan, enabling more accurate reporting without manual input.

    2 details in Everything

43. v0.19.5 Mar 25, 2022 · release notes

    Vuls v0.19.5 adds auto-detect library, inTheWild PoC support, and a packages-column report output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.5 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.5

    • Adds inthewild config key to detect inTheWild proof-of-concept exploits
    • Adds automatic library detection feature via the library subsystem
    • Replaces the NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. column with a packages-column in report output

    3 details in Everything

44. v0.19.4 Feb 16, 2022 · release notes

    Adds SLES 15, SLES 12 SP5, openSUSE, and SLED scanning support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.4

    • sles15, sles12sp5, opensuse, and sled added as scan targets

    1 detail in Everything

45. v0.19.3 Feb 9, 2022 · release notes

    Vuls v0.19.3 adds Fedora OS detection support and updates Trivy integration to v0.23.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.3

    • Adds Fedora platform support for vulnerability scanning

    1 detail in Everything

46. v0.19.1 Jan 7, 2022 · release notes

    Vuls v0.19.1 adds Amazon Linux 2022 detection support and updates go-kev dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.1

    • Updates the go-kev dependency to v0.1.0, requiring a database recreation due to schema changes

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The go-kev schema has changed in v0.1.0; existing Vuls databases must be recreated or scans may fail.
47. v0.19.0 Nov 19, 2021 · release notes

    Vuls v0.19.0 adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. Catalog alerts to vuls report and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

48. v0.18.1 Oct 13, 2021 · release notes

    v0.18.1 adds JSON logging, Amazon ALAS report links, Trivy update support, and HTTP mode to gost.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.18.1

    • Adds --log-json flag to enable structured JSON log output
    • Amazon ALAS vulnerability links are now included in generated reports

    2 details in Everything

49. v0.16.0 Sep 13, 2021 · release notes

    Vuls v0.16.0 adds library-only scanning via --library flag, Debian 11 support, and new goval-dictonary model.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    • Adds --library CLI argument to enable library-only vulnerability scanning.
    • Adds support for scanning Debian 11 (bullseye) distributions.
    • Integrates with the new goval-dictionary model format.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Vuls database schema has been changed, requiring users to delete the existing DB and fetch it again.
50. v0.15.14 Sep 7, 2021 · release notes

    Adds Alma Linux OS support and updates Trivy to v0.19.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.14 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.14

    • Adds Alma Linux OS platform support for vulnerability scanning
    • Updates internal trivy library to version v0.19.2

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The dependency on go-cve-dictionary is replaced by a new implementation; existing plugins or custom code linking directly to the old package will break.
    • !The dependency on go-exploitdb is replaced by a new implementation; existing plugins or custom code linking directly to the old package will break.
    • !CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. scan logic in cpescan has changed, potentially altering scan results for CPE identifiers.
51. v0.15.13 Jul 18, 2021 · release notes

    Vuls v0.15.13 adds Rocky Linux scanning, Go dependency scanning via go.sum, Nmap integration for ports, and Google Chat reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.13 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.13

    • Adds feat(os): support Rocky linux enabling vulnerability scanning on Rocky Linux distributions.
    • Adds feat(lib): support of Go (go.sum) scan to detect vulnerabilities in Go project dependencies.
    • Adds feat(scan): support external port scanner(nmap) in host machine to utilize Nmap for port detection.
    • Adds Feat report googlechat integration to send scan reports to Google Chat.

    4 details in Everything

52. v0.15.12 Jun 9, 2021 · release notes

    Vuls v0.15.12 adds Go go.sum scanning, nmap integration, and minor reporting fixes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.12 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.12

    └──▷ USE IT
    Configure Vuls to use an external nmap binary for host port detection.
    toml copy

    # Add the following to your config.toml
    [nmap]
    path = "/usr/bin/nmap"

    • Adds go.sum support for detecting vulnerabilities in Go library dependencies
    • Integrates external nmap port scanner to detect open ports on the host machine during scans

    2 details in Everything

53. v0.15.11 Apr 5, 2021 · release notes

    Vuls v0.15.11 adds -log-to-file flag for logging control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.11 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.11

    └──▷ USE IT
    Save all scanning output to a log file for later analysis.
    shell copy

    vuls scan -log-to-file

    • Adds the -log-to-file CLI flag to direct logs to a file

    1 detail in Everything

54. v0.15.8 Feb 10, 2021 · release notes

    Adds -diff flag to TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. and report commands to show resolved CVEs compared to previous scan

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.8 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.8

    └──▷ TRY IT
    Scan your infrastructure and immediately see which CVEs were resolved since the last run in the terminal UI.
    copy

    $ ./vuls tui --diff

    Generate a diff report to identify patched vulnerabilities for integration with CI/CD pipelines or ticketing systems.
    copy

    $ ./vuls report --format-full-text --diff > vuls_diff.txt

    • Adds --diff option to the CLI to enable vulnerability difference reporting in both the TUI and text reports
    • Enables vuls tui --diff to display resolved (patched) CVEs visually against the previous JSON report
    • Supports -diff on vuls report with existing formats (-format-list, -format-full-text, -format-one-line-text) to output patched item differences

    3 details in Everything

55. v0.15.5 Jan 27, 2021 · release notes

    Adds no-cvss-score range calculation and GitHub Security Advisory display support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.5 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.5

    • Displays GitHub Security Advisory details in reports

    1 detail in Everything

56. v0.15.4 Jan 27, 2021 · release notes

    Vuls v0.15.4 adds GitHub Security Advisory display and severity-based range calculation for CVEs without scores.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.4

    • Adds --github support to display GitHub Security Advisory details in reports
    • Implements range notion calculation by severity when --no-cvss-score is used and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score is missing

    2 details in Everything

57. v0.15.3 Jan 22, 2021 · release notes

    Adds default WordPress scanning configuration values in config.toml

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.3

58. v0.15.0 Jan 12, 2021 · release notes

    Adds DNF module support for RHEL8 scanning and EOL dates in scan summaries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    • Enables scanning of dnf modules on RHEL8 systems

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The structure of config.toml has been changed; some subcommand flags were removed (see PR #1122)
59. v0.14.0 Dec 23, 2020 · release notes

    Vuls v0.14.0 adds exploits, mitigations, and source URLs to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. reports via new ScanResult struct fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • Adds ScanResult>VulnInfos>CveContents>References>Tags field for displaying exploit and mitigation data from NVD
    • Adds ScanResult>VulnInfos>Mitigations field to store mitigation information in the report model

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ScanResult>VulnInfos>CveContents>Mitigation field is removed; consumers must use ScanResult>VulnInfos>Mitigations instead.
60. v0.13.7 Dec 4, 2020 · release notes

    Adds CGO_ENABLED=0 build support and expanded architecture binaries for easier deployment.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.7 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.13.7

    • Enables building Vuls with CGO_ENABLED=0 via the nocgo feature tag
    • Builds arm and 386 binaries alongside amd64 in release artifacts

    2 details in Everything

61. v0.13.0 Oct 19, 2020 · release notes

    Adds experimental TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port scanning via smart scanner to reduce network noise

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

62. v0.12.0 Aug 25, 2020 · release notes

    Vuls v0.12.0 adds Raspbian scanning via OVAL DB and Debian Security Tracker

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

63. v0.11.0 Jul 3, 2020 · release notes

    Adds [metasploit] database section to scan Metasploit module info for CVEs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Adds type, SQLite3Path, and url settings under the new [metasploit] config section to connect the Metasploit database

    1 detail in Everything

64. v0.9.8 Jun 17, 2020 · release notes

    Adds SMTPS support for email reports, a Trivy parser, WP-DB caching, ProxyJump SSH support, and an inactive plugin ignore flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.8 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.9.8

    • Supports ProxyJump option when using the ssh command
    • Added trivy parser to parse Trivy scan results
    • Added ReportedAt time for server mode reports
    • Caches WpVulnDB for WordPress plugin detection
    • Added -wp-ignore-inactive flag to ignore inactive plugins or themes

    +1 more show less

    • Supports SMTPS when using report -to-email

    6 details in Everything

65. v0.9.7 Jun 5, 2020 · release notes

    Vuls v0.9.7 adds Trivy parser support and -wp-ignore-inactive flag for WordPress scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.7 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.9.7

    • Adds trivy parser to scan WordPress environments using the Trivy engine (closes #981)
    • Adds -wp-ignore-inactive flag to skip inactive plugins or themes during WordPress scans

    2 details in Everything

66. v0.9.6 May 27, 2020 · release notes

    Adds kernel support for Ubuntu 20.04 via kernelnames

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.6 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.9.6

67. v0.9.2 Apr 8, 2020 · release notes

    Vuls v0.9.2 adds fixedIn field to affectedPackages in reports and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. display for fixed versions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.2 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.9.2

    └──▷ TRY IT
    Parse JSON reports to extract exact patch versions for remediation
    copy

    $ jq '.["CVE-2016-9840"].affectedPackages[].fixedIn' report.json

    • Adds fixedIn field to the affectedPackages array in JSON reports to expose the patched package version

    1 detail in Everything

68. v0.9.0 Sep 9, 2019 · release notes

    Vuls v0.9.0 adds -wordpress-only and -libs-only scan filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • Adds --wordpress-only and --libs-only flags to limit scanning scope
    • Enables offline scanning on Alpine Linux

    2 details in Everything

69. v0.8.4 Jul 17, 2019 · release notes

    Vuls v0.8.4 adds the --ips flag to the scan command for IP-based reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.8.4

    └──▷ TRY IT
    Scan a target and output detected vulnerabilities alongside their IP addresses.
    copy

    $ vuls scan --ips -config config.toml

70. v0.8.3 Jul 3, 2019 · release notes

    Vuls v0.8.3 adds running process details for vulnerable packages and fixes server mode race condition

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.8.3

    └──▷ USE IT
    Configure Vuls to skip reporting on will not fix vulnerabilities for Red Hat Enterprise Linux to reduce noise in your reports.
    toml copy

    # Configuration update in config.toml
    [servers]
      [servers.<server_name>]
        # ... other settings ...
        ignoreWillNotFix = true

    • feat(redhat) enables ignoring will not fix vulnerabilities on Red Hat systems
    • feat(fast-root) retrieves running processes for each vulnerable package across RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., CentOS, Amazon Linux, Ubuntu, and Debian

    2 details in Everything

71. v0.8.1 Jun 25, 2019 · release notes

    Adds server-mode support for Amazon Linux detection via -format-json and new HTTP headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.8.1

    └──▷ USE IT
    Ingest Amazon Linux 2 package list via plain-text HTTP endpoint
    shell copy

    curl -X POST -H 'X-Vuls-OS-Family: amazon' -H 'Content-Type: text/plain' --data-binary "$(rpm -qa --queryformat "%{NAME} %{EPOCHNUM} %{VERSION} %{RELEASE} %{ARCH}\n")" http://<HOST_IP>:5515/vuls

    Ingest Amazon Linux package data via JSON API
    shell copy

    curl -X POST -H 'Content-Type: application/json' -d '{"Family": "amazon", "Release": "2 (Karoo)", "Packages": {"kernel": {"Name": "kernel", "Version": "4.14.114"}}}' http://localhost:5515/vuls

    • Adds amazon OS family support in server mode to detect vulnerabilities on Amazon Linux instances
    • Accepts X-Vuls-OS-Family: amazon header for plain-text package submission
    • Supports JSON body with Family: amazon field for structured package data ingestion

    3 details in Everything

72. v0.8.0 Jun 18, 2019 · release notes

    Adds container image and smart programming language library scanning via new [servers.image] and servers.abuntu lockfiles config sections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    • Add type="pseudo" in [servers.image] to enable Container Image Scan for targets like GCR or local images.
    • Add lockfiles array (e.g. package-lock.json, yarn.lock) under [servers.abuntu] (or other server sections) to enable Smart Programming Language Library Scan.

    2 details in Everything

73. v0.7.0 Apr 8, 2019 · release notes

    Adds WordPress vulnerability scanning for core, plugins, and themes via wp-cli and WPVulnDB

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ USE IT
    Configure a server section in config.toml to target a specific WordPress installation, pointing Vuls to the WP-CLI binary and providing your API token.
    config copy

    [servers.my-wordpress]
      user = "root"
      host = "10.10.10.10"
      port = "22"
    
    [servers.my-wordpress.wordpress]
      cmdPath = "/usr/local/bin/wp"
      osUser = "wordpress"
      docRoot = "/var/www/html"
      wpVulnDBToken = "your-wpvulndb-token"
      ignoreInactive = true

    Run a scan on the configured WordPress server to detect core and extension vulnerabilities.
    shell copy

    vuls scan my-wordpress

    • Adds [servers.<name>.wordpress] configuration section in config.toml with keys cmdPath, osUser, docRoot, wpVulnDBToken, and ignoreInactive to define WordPress scan targets.
    • Enables vuls scan <server-name> to collect WordPress Core, plugin, and theme versions via wp-cli when a WordPress server config is present.
    • Adds integration with [WPVulnDB.com](https://wpvulndb.com/api) to detect vulnerabilities for identified WordPress components during the scan.

    3 details in Everything

74. v0.6.3 Feb 20, 2019 · release notes

    Vuls v0.6.3 adds new GitHub Security Alerts integration to report feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.3 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.6.3

    └──▷ TRY IT
    Automate scanning and reporting vulnerabilities to GitHub Security Advisories.
    copy

    $ vuls report --github

75. v0.6.2 Jan 22, 2019 · release notes

    Adds Telegram alerting support and JSON alerts field

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.2 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.6.2

    └──▷ HOW TO FIND IT
    Send vulnerability scan alerts to a Telegram channel instead of email.
    📍vuls report -to-telegram <bot_token> <chat_id>
    • Adds Telegram as a notification destination via new -to-telegram flag
    • Adds alerts array to scan result JSON output for structured alert data

    2 details in Everything

76. v0.6.1 Nov 16, 2018 · release notes

    v0.6.1 adds an exploit-db integration and new -cvedb-type flag for custom CVE database URLs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.6.1

    └──▷ USE IT
    Use a custom API to fetch CVE details instead of the default source.
    shell copy

    vuls scan -cvedb-type=http -cvedb-url="https://my-custom-cve-api.com/"

    • Adds -cvedb-type CLI argument to specify the CVE database backend type
    • Adds support for fetching CVE details via a custom HTTP URL using -cvedb-url
    • Integrates exploit-db data into vulnerability reports

    3 details in Everything

77. v0.5.0 Aug 27, 2018 · release notes

    Vuls v0.5.0 adds HTTP scanning endpoint, gost datasource, per-server scan modes, and report notifications

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    └──▷ USE IT
    Configure a specific server to run deep scans with offline detection capabilities via config
    config copy

    [servers.localhost]
    host = "192.168.100.111"
    port = "22"
    scanMode = ["deep"]
    
    [gost]
    type = "sqlite3"
    path = "/path/to/gost.sqlite3"

    Scan a CentOS 6.9 host for vulnerabilities using the new HTTP POST endpoint without installing local tooling
    shell copy

    curl -X POST -H "Content-Type: text/plain" \
        -H "X-Vuls-OS-Family: centos" \
        -H "X-Vuls-OS-Release: 6.9" \
        -H "X-Vuls-Kernel-Release: $(uname -r)" \
        --data-binary "$(rpm -qa --queryformat "%{NAME} %{EPOCHNUM} %{VERSION} %{RELEASE} %{ARCH}\n")" \
        http://localhost:5515/vuls

    Filter out specific packages for a container using regex patterns in the config file
    config copy

    [servers.192-168-11-6.containers.container_name_a]
    ignorePkgsRegexp = ["^vim.*"]
    host = "192.168.11.6"

    • Adds scanMode config key under [servers.*] in config.toml to define per-server scanning profiles such as fast, fast-root, deep, and offline
    • Adds support for the gost datasource ([gost] section in config.toml) to detect vulnerabilities where distributor patches are not yet published
    • Adds HTTP server mode listening on port 5515 at /vuls endpoint for one-liner scanning via POST requests
    • Enables per-container cpeNames, owaspDCXMLPath, and ignoreCves configuration keys under [servers.<host>.containers.<name>] in config.toml
    • Adds ignorePkgsRegexp config key under [servers.*] for host-level or container-level package filtering using regular expressions

    +2 more show less

    • Enables CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. name display, OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. TOP 10 mapping, and Mitigation info in TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. reports
    • Adds Slack, Stride, and Chatwork notification integrations for scan results via corresponding config sections ([slack], [stride], [chatwork]) in config.toml

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The configuration file format changed: the optional field previously defined as a list of key-value pairs under [servers.<host>] is now nested under [servers.<host>.Optional] with flat key=value syntax.
    • !The ScanResult JSON model format has changed (see /models directory in source).
78. v0.4.1 Oct 19, 2017 · release notes

    Adds SUSE Enterprise Linux support, -ignore-unfixed to report, and filters to TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.1 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.4.1

    └──▷ USE IT
    Scan SUSE Enterprise Linux hosts during vulnerability assessment.
    shell copy

    vuls scan --os-type suse <target>

    Generate a report excluding unpatched vulnerabilities.
    shell copy

    vuls report -ignore-unfixed

    Filter servers in the interactive TUI interface.
    shell copy

    vuls tui --filter <expression>

    • Adds suse platform support for vulnerability detection.
    • Adds -ignore-unfixed flag to the report subcommand.
    • Adds filter options to the tui subcommand.

    3 details in Everything

79. v0.4.0 Aug 25, 2017 · release notes

    Vuls v0.4.0 introduces fast nosudo scan mode, deep scan mode with changelog parsing, reboot notifications, and OVAL support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds Fast nosudo scan mode as the default scanning method to allow ultra-high speed vulnerability detection without root privileges or internet connectivity
    • Adds Deep scan mode which parses package changelogs for more accurate CVE detection on Ubuntu, Debian, and CentOS
    • Enables notifications when a reboot is required after kernel updates by warning users during the scan
    • Integrates OVAL data sources to improve vulnerability detection accuracy for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., CentOS, Debian, Ubuntu, and OracleLinux
    • Changes yum update --changelog to yum changelog from yum-utils to fetch changelogs without requiring root privileges

    +1 more show less

    • Adds display of yum plugin-security information in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. for RHEL, Amazon, and Oracle targets

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The structure of the models has changed, making this version not backward compatible with previous configurations or outputs
80. 0.3.0 Mar 24, 2017 · release notes

    Vuls v0.3.0 adds LXD and Oracle Linux support, local scanning mode, report subcommand with diff notifications, and confidence scores.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.3.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout 0.3.0

    • Add report subcommand to generate reports after a scan
    • Add -format-one-email option to the vuls report command to send one email per vulnerability instead of one consolidated email
    • Support scanning on RHEL5, Raspbian, and Oracle Linux distributions
    • Add config.toml section for LXD container configuration to enable scanning LXD-based targets
    • Enable local scan mode (--scan-local or equivalent internal flag) to scan the localhost without requiring SSH connectivity

    +2 more show less

    • Notify the difference from the previous scan result in reports, highlighting only changed vulnerabilities
    • Output confidence score of detection accuracy and detection method to JSON output

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecate prepare subcommand to minimize the root authority defined by /etc/sudoers
    • !Obsolete CentOS5 support
81. 0.2.0 Jan 10, 2017 · release notes

    Adds vuls report subcommand and --assume-yes flag to prepare for automation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.2.0 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout 0.2.0

    └──▷ TRY IT
    Generate a JSON report for recently scanned vulnerabilities.
    copy

    $ vuls report -format-json

    Run non-interactive preparation on a Debian/Ubuntu host to install dependencies.
    copy

    $ vuls prepare --assume-yes

    • Adds the report subcommand to generate vulnerability reports from scanned data.
    • Adds the --assume-yes flag to vuls prepare to bypass interactive prompts.

    2 details in Everything

82. 0.1.7 Nov 8, 2016 · release notes

    Vuls 0.1.7 adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Dep Check integration, XML output, MySQL CVE source, and Docker-only scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.7 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout 0.1.7

    └──▷ TRY IT
    Scan only Docker containers without scanning the host OS.
    copy

    $ vuls scan --only-containers

    Export scan results to XML for external processing.
    copy

    $ vuls scan -format-xml

    • -skip-broken option for yum to handle broken packages
    • Support for -ssh-external in the prepare subcommand
    • Integration with OWASP Dependency Check
    • Reading CVE data from a MySQL database
    • XML output format for scan reports

    +3 more show less

    • ignoreCveIDs config key to filter specific vulnerabilities
    • --enable-repos (yum) and --only-containers options
    • Display of unknown CVEs in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.

    8 details in Everything

83. 0.1.6 Sep 12, 2016 · release notes

    Vuls v0.1.6 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. support and sudoless Amazon Linux scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.6 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout 0.1.6

    • Adds Support for CWE (Common Weakness EnumerationCommon Weakness EnumerationCommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.) to report weaknesse categories alongside vulnerabilities
    • Enables scanning on Amazon Linux without requiring sudo privileges via improved privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. handling

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated options -use-unattended-upgrades and -use-yum-plugin-security are removed
84. 0.1.5 Aug 16, 2016 · release notes

    Vuls 0.1.5 adds configtest subcommand, external SSH support, platform detection, and new report/config options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.1.5 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout 0.1.5

    • Adds configtest subcommand to validate configuration files before scanning.
    • Supports the -external-ssh option to use an external SSH command for remote scanning.
    • Detects Amazon EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. platform and extracts the instance-id automatically.
    • Adds the -report-azure-blob option to send scan results directly to Azure Blob Storage.
    • Adds the -report-s3 option to export findings to an Amazon S3 bucket.

    +3 more show less

    • Supports FreeBSD as a scanned platform for vulnerability detection.
    • Enables optional key-value output in JSON report configuration.
    • Allows scanning without running go-cve-dictionary in server mode.

    8 details in Everything

85. v0.1.4 May 24, 2016 · release notes

    Vuls v0.1.4 introduces ERD changes requiring a new SQLite3 data file

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.4 https://github.com/future-architect/vuls.git
    # already have the repo? check out this version:
    $ git checkout v0.1.4

    • vuls now uses a changed ERD that necessitates using a new SQLite3 data file during upgrade.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading to v0.1.4 requires using a new SQLite3 data file; the existing database schema is incompatible due to ERD changes.