The Unified Security Stack vulnerability scanner uses a strong mix of open-source tools that meet industry standards and proprietary threat intelligence to protect your systems. This page describes the main technologies behind our detection engines, such as Nuclei templates, the CVE Binary Tool, and our internal application scanner.
flowchart TD
Scanner["Vulnerability Scanner"] --> Network["Network & General Scans"]
Scanner --> Agent["Agent-Based Scans"]
Scanner --> App["Application Scans"]
Network --> Nuclei["Nuclei Templates"]
Agent --> CVE["CVE Binary Tool"]
App --> InHouse["In-House Engine"]
Nuclei --> Community["Community Research"]
CVE --> Databases["NVD, OSV, Redhat, etc."]
InHouse --> ThreatIntel["UTM Threat Intelligence"]Network and General Scanning
For general vulnerability detection, the platform uses the NUCLE-A standard for templates. This engine depends on Nuclei templates, which are YAML-based files that are highly extensible and specify precisely how security requests are sent and handled.
Since YAML is a straightforward, human-readable format, security teams can rapidly define execution processes, severity ratings, and detection methods. Thousands of security researchers around the world actively develop this open-source tool, which ensures quick response to new threats.
Global security researchers drive the Nuclei community. If you want to contribute, explore our Pioneers and Bounties programs that help enhance detection capabilities for all.
Agent-Based Scanning
When you run agent-based scans, the system utilizes the CVE Binary Tool, an open-source tool first created by Intel. This utility is built to identify known vulnerabilities in your software supply chain and can automatically produce Software Bills of Materials (SBOMs).
The CVE Binary Tool pulls vulnerability data from several trusted sources:
National Vulnerability Database (NVD)
Redhat
Open Source Vulnerability Database (OSV)
Gitlab Advisory Database (GAD)
Curl
Although the CVE Binary Tool actively uses the NVD API to retrieve the newest vulnerability data, the NVD does not officially endorse or certify it.
Scanning Modes
The CVE Binary Tool operates in two primary modes to ensure comprehensive coverage of your environment:
| Scanning Mode | Description | Key Capabilities |
|---|---|---|
| Binary Scanner | Examines compiled software to identify which packages were included in the build. | Features over 447 checkers focusing on common open-source components like openssl, libpng, libxml2, and expat. |
| Component List Scanner | Checks known component lists and manifests for versions with vulnerabilities. | Supports .csv files, package lists from Linux distributions, package managers specific to languages, and multiple SBOM formats. |
Application Scanning
To detect vulnerabilities within the applications installed directly on your servers, we use a specialized in-house detection engine.
This application scanner merges our proprietary build detection mechanisms with a diverse mix of threat intelligence. By comparing installed software against the NVD, Red Hat advisories, and UTM Stacked Threat Intelligence, the scanner precisely maps known vulnerabilities to your particular server environments, delivering actionable insights that let you patch and safeguard your infrastructure.