Frequently asked questions
How CVEScan works, what data we use, and what happens when you upload an inventory file.
How do I check installed programs for CVEs?
Open CVEScan, choose Local Programs, pick your OS, copy the inventory command, and run it on your machine. That command only lists installed software and versions into scan_results.txt — it does not modify the system. Upload the file in the browser. We resolve each product to a CPE, match it against NVD, and show CVEs with CVSS severity so you can see what is unpatched.
How does CPE to CVE matching work?
CPE (Common Platform Enumeration) is a standard way to name a product and version. CVEScan normalizes each line from your inventory to a CPE-like identity, then looks up which CVEs in the National Vulnerability Database (NVD) apply to that software. Results can include CVSS scores and, when available, signals such as CISA KEV or VulnCheck enrichment so you can prioritize what to fix first.
Is it safe to upload scan_results.txt?
Yes. Client scan files from the web product are never stored. The file is processed for matching and discarded afterward — it is not kept for marketing, training, or later reuse. Prefer running the inventory command yourself and uploading only the text output you generated. If you use the commercial External API, that path reads the shared vulnerability catalog and does not keep your web-upload inventories either.
Can I scan Linux, Windows, and macOS packages for vulnerabilities?
Yes. Local Programs currently supports inventory commands for macOS, Linux, Windows, iPhone, and Android. Each OS tab shows a read-only command tailored to that platform. After you upload the result, matching works the same way: installed software → CPE → CVE. Coverage depends on how well the product names/versions map into CPE and NVD data.
What is a runtime CVE scanner?
A runtime CVE scanner checks software that is actually installed on a device (apps, packages, versions) — not only lockfiles or source dependencies in a repo. That helps answer “what on this machine is vulnerable right now?” CVEScan focuses on that inventory → CPE → CVE flow against live vulnerability feeds such as NVD, with CVSS and optional KEV / VulnCheck context.
Where does CVEScan get vulnerability data?
The product is built around NVD as the primary CVE catalog (shown as NVD LIVE in the UI). We also surface related live-feed context such as VulnCheck and CISA KEV when available, so findings are not only theoretical severity — they can reflect known exploitation signals. Exact enrichment can evolve as feeds are updated.
What are Browser and Network scan modes?
Browser mode: enter a public website URL. CVEScan probes HTTP headers and HTML signals, then matches detected products to NVD CVEs. Network mode: run nmap `-sV -oX`, upload the XML, and match discovered services/products to CVEs. Local Programs remains the installed-software scan, including iPhone (beta).
Do I need an account or API key to use the website scanner?
No account is required for the public Local Programs flow: pick OS, run the command, upload scan_results.txt, and view matches. The External API is a separate commercial CPE → CVE matching interface for integrations and requires an API key. Contact [email protected] if you need API access.
What file format should I upload?
Upload a plain-text .txt file produced by the OS command shown in the UI (typically named scan_results.txt). The content should be a software inventory — package or app names with versions — not a binary installer or screenshot. If parsing fails, re-run the command for your OS tab and upload the fresh output.
Why might some installed programs show no CVEs?
No match can mean the product is not in NVD under a resolvable CPE, the version string could not be parsed, the name is too generic, or there are simply no published CVEs for that version. Try clearer product names when possible. Absence of results is not a guarantee the software is safe — it means we could not confidently map it in the current catalog.