cvENGINE: the most advanced external attack surface assessment you can get for free.
hevnsnt/CVEngine
It exists because of Black October. I wanted a self-hosted tool, built from the best open source tools there are, that answers one question: of all the vulns released every 30 minutes, do I have any of this exposed?
Point it at a domain. cvENGINE auto-discovers every subdomain, IP, and open port, fingerprints every service, and matches what it finds against today’s exploited CVEs. Then an AI reproduces what it can with read-only checks and tells you which CVEs can actually hit you.
One Docker Compose stack. Open source (GPL-3.0). Self-hosted. Bring your own AI keys, or run a local model. No license fee, no per-asset pricing, and nothing is sent to me.
Under the hood:
Discovery and scanning
- bbot (Black Lantern Security): blacklanternsecurity/bbot
- Nuclei and its templates (ProjectDiscovery): projectdiscovery/nuclei
- naabu (ProjectDiscovery): projectdiscovery/naabu
- nmap: nmap.org
- WPScan: wpscan.com
- node2shell scanner (Assetnote): assetnote/node2shell-scanner
- MailFail (Black Hills Information Security): ACK-J/MailFail
Exploitation intelligence behind the fire, smoke, and ice ratings
- cve.now: cve.now
- CISA KEV: cisa.gov
- VulnCheck KEV: vulncheck.com
- EPSS (FIRST): first.org
- Exploit-DB: gitlab.com
- Metasploit: rapid7/metasploit-framework
Thank you to every maintainer who builds in the open. None of this exists without you.
29 points · 1 comment
Mentions
一个黑盒漏洞检测工具，正式开源 我们发布了用于 node2shell 的高保真扫描器，帮助安全研究人员更精准地识别这一问题，并为社区提供可复用的检测能力 检测逻辑由 @hash_kitten 于上周晚些时候编写 现在开放源码，希望它能为公共利益贡献一份力量 assetnote/node2shell-scanner
cvENGINE: the most advanced external attack surface assessment you can get for free. hevnsnt/CVEngine It exists because of Black October. I wanted a self-hosted tool, built from the best open source tools there are, that answers one question: of all the vulns released every 30 minutes, do I have any of this exposed? Point it at a domain. cvENGINE auto-discovers every subdomain, IP, and open port, fingerprints every service, and matches what it finds against today’s exploited CVEs. Then an AI reproduces what it can with read-only checks and tells you which CVEs can actually hit you. One Docker Compose stack. Open source (GPL-3.0). Self-hosted. Bring your own AI keys, or run a local model. No license fee, no per-asset pricing, and nothing is sent to me. Under the hood: Discovery and scanning - bbot (Black Lantern Security): blacklanternsecurity/bbot - Nuclei and its templates (ProjectDiscovery): projectdiscovery/nuclei - naabu (ProjectDiscovery): projectdiscovery/naabu - nmap: nmap.org - WPScan: wpscan.com - node2shell scanner (Assetnote): assetnote/node2shell-scanner - MailFail (Black Hills Information Security): ACK-J/MailFail Exploitation intelligence behind the fire, smoke, and ice ratings - cve.now: cve.now - CISA KEV: cisa.gov - VulnCheck KEV: vulncheck.com - EPSS (FIRST): first.org - Exploit-DB: gitlab.com - Metasploit: rapid7/metasploit-framework Thank you to every maintainer who builds in the open. None of this exists without you.
High fidelity detection mechanism for node2shell (CVE-2026-111497) assetnote/node2shell-scanner
Node2Shell güvenlik açığını tespit etmek amacıyla Node.js HTTP uygulamalarını uzaktan test eden bir tarama aracı. assetnote/node2shell-scanner
Published our high fidelity scanner for node2shell: assetnote/node2shell-scanner Detection logic was written by @hash_kitten late last week. Open sourcing it to do public good in detecting this issue black box.