"CVE scanner" is a term that gets used loosely, so let's pin it down. A CVE scanner checks your systems for known vulnerabilities — entries in the CVE catalog that have public identifiers, published exploits or proofs of concept, and usually vendor advisories. It is not a fuzzer, not a fuzzer's cousin, and not a replacement for understanding your attack surface. It's a lookup: do the things you run match things the world already knows are broken?
Here's how the open-source options actually work, and where each one stops.
Nuclei: template-driven detection
Nuclei approaches CVE detection through templates — thousands of community-maintained YAML files that each describe a request (or sequence of requests) and the response pattern that indicates a vulnerability. This has real advantages:
- It tests live behavior, not version strings. A Nuclei template sends the actual probe. If the endpoint responds in a way that matches the vulnerability, that's evidence, not a guess from a banner.
- Speed. Templates are lightweight and run in parallel across thousands of hosts.
- Fresh coverage. New CVEs with public exploits get templates within days, sometimes hours. The template repository is one of the fastest-moving detection feeds in open source.
The trade-off: template coverage is breadth-first. Nuclei is strongest on web-exposed issues — exposed panels, known injection points, misconfigurations, CVEs with HTTP-reachable triggers. It will not inventory your software and tell you "everything installed on this host has these 40 CVEs." That's a different tool's job.
If you go this route, our Nuclei templates guide covers how the template system is organized and how to filter by severity and tag.
Trivy: inventory-first scanning
Trivy (from Aqua Security) answers the inventory question. It scans what's installed — OS packages, language dependencies, container images, IaC configs — and matches versions against vulnerability databases to produce a CVE list. It's the right tool when the question is "what known-bad software versions exist in this image or host?"
Its limitation mirrors Nuclei's: it matches versions, it doesn't confirm exploitability. Version matching produces false positives — backported patches, vulnerable-version-but-not-vulnerable-config — and it can't see anything about your network exposure. It's also aimed at hosts, images, and repos rather than live network targets.
OpenVAS: the traditional network scanner
OpenVAS (Greenbone) is the classic: a signed feed of network vulnerability tests (tens of thousands of them), a scan engine, and a heavyweight management interface. It inventories services across a network and runs version- and behavior-based checks against its feed. If your mental model of "vulnerability scanner" came from Nessus, OpenVAS is the open-source equivalent.
It's comprehensive and slow. The feed is the value; the operational cost — installation, feed syncs, scan tuning, false-positive triage — is the tax. Our OpenVAS tutorial covers the practical setup if you want to run it yourself.
The honest comparison
| Tool | Approach | Best at | Weak at | |---|---|---|---| | Nuclei | Live HTTP probes from templates | Web-exposed CVEs, misconfigurations, exposed services | Non-HTTP services, host inventory | | Trivy | Version matching against installed packages | Containers, dependencies, hosts you control | Network reachability, exploitability | | OpenVAS | Signed feed of network vuln tests | Broad network coverage with management tooling | Speed, setup cost, false-positive noise |
These complement each other; none replaces the others. A realistic open-source program is Nmap for mapping, then Nuclei and/or OpenVAS for CVE detection, then Trivy for anything containerized — which is roughly the stack described in our best open-source vulnerability scanners comparison.
The part nobody advertises
Whichever scanner you pick, the output is a raw feed of findings, and raw CVE lists are where programs die. Findings need deduplication, severity context ("critical for this exposed service" vs. "informational for that internal one"), and remediation language a human can act on. If the scan result is a 4,000-line JSON file, the CVEs are technically scanned and practically ignored.
That's the gap between scanning and vulnerability management, and it's why we built VulnScanners: the open-source engines — Nuclei, Nmap, ZAP — hosted, with findings parsed into severity-rated, evidence-backed results and delivered as client-ready PDF reports. Run a free scan on a target you own and see what the CVE list looks like when someone else handles the operations.