cvENGINE

cvENGINE is a GPL-3.0 open-source, self-hosted external attack surface assessment platform published on GitHub by hevnsnt. Starting from a domain, IP, CIDR range, or URL, it discovers internet-facing assets, fingerprints services and versions, and matches them against currently exploited CVEs. The latest listed release is v1.1.2.

What It Is

cvENGINE combines attack surface discovery, vulnerability scanning, and CVE threat-feed matching into one continuous pipeline. Per the README, it is a fork of reNgine 2.x. It stores hosts, ports, services, products, versions, OS, banners, TLS, and technologies in a searchable inventory. It runs as a Docker Compose stack with its scanners built in, and no agents are required.

How the Pipeline Works

Discovery uses bbot in passive, standard, and deep modes, plus a certificate transparency watch. nmap, naabu, and nuclei fingerprint hosts, and exposure checks cover databases such as Redis and PostgreSQL. A CVE feed (cve.now) and sources such as CISA KEV, ENISA EUVD, Metasploit, Exploit-DB, EPSS, and CVSS are rated fire, smoke, or ice and matched to the inventory by product and version. Each host gets a 0 to 100 score with reasons shown.

Validation and AI Triage

AI triage classifies findings as confirmed, likely, needs validation, likely false positive, or not applicable. Read-only validation, such as a vetted nuclei template, a single-port nmap check, or a banner probe, records the exact command it ran. When no template exists the AI can draft one, but it does not run until a person approves it. Users bring their own model (Anthropic, OpenAI, OpenRouter, Ollama, or vLLM); without a model, discovery, scanning, CVE matching, and validation still work.

Operating and Integrating

The tool offers Shodan-style search, a live dashboard, and a Changes timeline with screenshot diffs. It also provides organizations, projects, roles, two-step sign-in, an IP allowlist, an audit log, a REST API, an MCP server, and an OpenAPI spec. Alerts can go to Slack, Discord, Telegram, and Lark, and an optional bug bounty workbench is available. The README states to scan only systems you own or are authorized to test.

Setup Path

The documented install targets a Linux server (Debian or Ubuntu is easiest; 4 GB of RAM and 20 GB of disk or more) and runs through a single install script that sets up Docker, secrets, and an HTTPS certificate, with a setup wizard afterwards.