OS / package vulnerabilities (Host SCA)
Even if your application code is safe, outdated OS packages and runtime libraries on the server become an entry point in themselves. This collects the installed packages of a server connected over SSH and checks for known vulnerabilities (CVEs). It is used in the Server / Host service.
The list of installed packages is collected from the server, turned into an SBOM, and then matched against CVEs. No heavy agent is kept resident on the server; collection happens only when needed, over the registered SSH connection.
What it finds
- Known CVEs in OS packages (rpm/deb, etc.)
- Vulnerabilities in runtimes/libraries installed on the server
- Supported targets: OS packages (Alpine / Debian / Ubuntu / RHEL / Amazon Linux, etc.) and installed app dependency ecosystems (npm · PyPI · Maven / Gradle · Go, etc.)
Each CVE is shown together with its real-world exploitation status and risk indicators.
- KEV Vulnerabilities confirmed to be exploited in the wild (priority for remediation)
- EPSS Score for the likelihood of future exploitation
- CWE Vulnerability type classification
Viewing results
Findings are organized by severity and are triaged the same way as other analyses in Vulnerability management. Remediate by updating the package, and if there is no real impact, mark it as accepted risk.
Continuous monitoring
The collected package inventory is monitored continuously, so when a new CVE is published it is detected and alerted without a rescan. (Security news)