Skip to main content

OS / package vulnerabilities (Host SCA)

Host SCA is the analysis that collects the OS packages and runtime libraries actually installed on your running server and matches them against known vulnerabilities (CVEs).

No matter how safe your application code is, outdated OS packages or runtimes on the server become an entry point in themselves. What matters is not what an image or manifest says is installed, but what is actually on the server right now. Manual patches, urgent hotfixes, and packages installed outside of management can all make the running state differ from any image or definition file.

Here is how it works. It connects to the server over the registered SSH connection, collects installed package information, and matches it against known-vulnerability databases. No resident agent is kept on the server; collection happens only when needed, so it checks the actual running state as it really is. It is used in the Server / Host service.

  • Analysis : Known CVEs in server OS packages and runtime libraries
  • What you need : A Server / Host registered and connected over SSH
  • Results : CVEs by severity, plus KEV / EPSS / CWE
How it works

Installed package information is collected from the server and matched against CVEs. No agent is kept resident on the server; collection happens only when needed, over the registered SSH connection.

How this differs from SCA

Dependency vulnerability scanning of source code and container images is called SCA and is covered in SCA and Image SCA. This page is separate: it checks the vulnerabilities of the OS packages actually installed on a running server.

What it finds​

  • Known CVEs in OS packages (rpm/deb, etc.)
  • Vulnerabilities in runtimes/libraries installed on the server
  • Supported targets
    • OS packages : Alpine / Debian / Ubuntu / RHEL / Amazon Linux, etc.
    • App dependencies : npm · yarn · pnpm · PyPI (requirements.txt) · Maven (pom.xml) · Go · RubyGems · Cargo files inside the scan path
    • Scope by OS family : App dependencies are checked only on Debian · Ubuntu · Alpine family servers. RHEL-family servers are checked for OS packages only.

Each CVE is shown together with its real-world exploitation status and risk indicators.

  • KEV Vulnerabilities confirmed to be exploited in the wild (priority for remediation)
  • EPSS : Likelihood of exploitation in the near future
  • CWE : Vulnerability type classification (used for compliance mapping)

Viewing results​

Findings are organized by severity and are triaged the same way as other analyses in Vulnerability management.

OS / package vulnerability resultsOS / package vulnerability results
Shows CVEs found in the collected server packages, ordered by severity. Judge priority from each item's KEV · EPSS · CWE and triage right here.
OS / package vulnerability detail drawerOS / package vulnerability detail drawer
Click an item to open the detail drawer with the CVE description, the installed package version, and the fixed version.

Handling results​

  • Remediate by updating the vulnerable package.
  • Judge the remediation order from KEV and EPSS · CWE.
  • If there is no real impact, mark it as accepted risk and, if needed, export the rationale as VEX.