# cvENGINE

> Open-source, self-hosted external attack surface assessment that discovers internet-facing assets, matches exploited CVEs to them, and validates findings with read-only checks.

cvENGINE is a GPL-3.0 open-source, self-hosted external attack surface assessment platform published on GitHub by hevnsnt. Starting from a domain, IP, CIDR range, or URL, it discovers internet-facing assets, fingerprints services and versions, and matches them against currently exploited CVEs. The latest listed release is v1.1.2.

## What It Is

cvENGINE combines attack surface discovery, vulnerability scanning, and CVE threat-feed matching into one continuous pipeline. Per the README, it is a fork of reNgine 2.x. It stores hosts, ports, services, products, versions, OS, banners, TLS, and technologies in a searchable inventory. It runs as a Docker Compose stack with its scanners built in, and no agents are required.

## How the Pipeline Works

Discovery uses bbot in passive, standard, and deep modes, plus a certificate transparency watch. nmap, naabu, and nuclei fingerprint hosts, and exposure checks cover databases such as Redis and PostgreSQL. A CVE feed (cve.now) and sources such as CISA KEV, ENISA EUVD, Metasploit, Exploit-DB, EPSS, and CVSS are rated fire, smoke, or ice and matched to the inventory by product and version. Each host gets a 0 to 100 score with reasons shown.

## Validation and AI Triage

AI triage classifies findings as confirmed, likely, needs validation, likely false positive, or not applicable. Read-only validation, such as a vetted nuclei template, a single-port nmap check, or a banner probe, records the exact command it ran. When no template exists the AI can draft one, but it does not run until a person approves it. Users bring their own model (Anthropic, OpenAI, OpenRouter, Ollama, or vLLM); without a model, discovery, scanning, CVE matching, and validation still work.

## Operating and Integrating

The tool offers Shodan-style search, a live dashboard, and a Changes timeline with screenshot diffs. It also provides organizations, projects, roles, two-step sign-in, an IP allowlist, an audit log, a REST API, an MCP server, and an OpenAPI spec. Alerts can go to Slack, Discord, Telegram, and Lark, and an optional bug bounty workbench is available. The README states to scan only systems you own or are authorized to test.

## Setup Path

The documented install targets a Linux server (Debian or Ubuntu is easiest; 4 GB of RAM and 20 GB of disk or more) and runs through a single install script that sets up Docker, secrets, and an HTTPS certificate, with a setup wizard afterwards.

## Features
- Continuous asset discovery with bbot in passive, standard, and deep modes
- Certificate transparency watch
- Port and service fingerprinting with nmap, naabu, and nuclei
- Fire, smoke, and ice CVE ratings from CISA KEV, ENISA EUVD, Metasploit, Exploit-DB, EPSS, and CVSS
- Host scoring from 0 to 100 with reasons
- AI triage of findings
- Read-only automated CVE validation
- AI-drafted nuclei templates requiring human approval
- Shodan-style search over inventory
- Change timeline with screenshot diffs
- Email and domain hygiene checks
- Organizations, projects, roles, two-step sign-in, IP allowlist, and audit log
- REST API, MCP server, and OpenAPI spec
- Bug bounty workbench
- Slack, Discord, Telegram, and Lark alerts

## Integrations
bbot, nuclei, nmap, naabu, gowitness, WPScan, CISA KEV, ENISA EUVD, Metasploit, Exploit-DB, VulnCheck KEV, Anthropic, OpenAI, OpenRouter, Ollama, vLLM, Model Context Protocol, HackerOne, Bugcrowd, Intigriti, YesWeHack, Slack, Discord, Telegram, Lark

## Platforms
LINUX, WEB, API

## Pricing
Open Source

## Version
v1.1.2

## Links
- Website: https://github.com/hevnsnt/CVEngine
- Documentation: https://github.com/hevnsnt/CVEngine/tree/master/docs
- Repository: https://github.com/hevnsnt/CVEngine
- EveryDev.ai: https://www.everydev.ai/tools/cvengine