How to scan your infrastructure for CVEs

A practical guide to finding known vulnerabilities in your endpoints, containers, and packages — using free, open-source tools.

1. Scan web endpoints with Nuclei

Nuclei is the fastest way to check if a target is vulnerable to a specific CVE. It uses community-maintained templates — many are added within hours of a disclosure.

Nuclei Free Web & API Network

Install:

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# or via brew:
brew install nuclei

Scan a host for all CVE templates:

nuclei -u https://your-target.com -tags cve -o results.txt

Scan for a specific CVE (e.g. after spotting it on vulnfeed):

nuclei -u https://your-target.com -id CVE-2024-1234

Scan a list of hosts, only critical/high severity:

nuclei -list hosts.txt -tags cve -severity critical,high -o cve-results.json -jsonl

Update templates to get the latest CVE checks:

nuclei -update-templates

Tip: When you see a new CVE on vulnfeed, check the nuclei-templates CVE directory — search by CVE ID to see if a template exists. If it does, you can test your exposure immediately.

2. Scan containers and filesystems with Trivy

Trivy scans container images, filesystems, and code repos for known CVEs in installed packages. Essential for any team running Docker or Kubernetes.

Trivy Free Containers Packages

Install:

brew install aquasecurity/trivy/trivy
# or via apt:
apt install trivy

Scan a Docker image:

trivy image nginx:latest
trivy image --severity CRITICAL,HIGH your-app:latest

Scan the local filesystem (e.g. a Python/Node project):

trivy fs .
trivy fs --severity CRITICAL /path/to/project

Scan a running Kubernetes cluster:

trivy k8s --report summary cluster

Output as JSON for ingestion into other tools:

trivy image -f json -o results.json nginx:latest

3. Scan installed packages with Grype

Grype is a fast vulnerability scanner for container images and filesystems. Pairs well with Trivy as a second opinion.

Grype Free Containers OS packages

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

grype your-image:latest
grype dir:/path/to/project
grype sbom:/path/to/sbom.json       # scan from an SBOM
grype your-image:latest -o json | jq '.matches[] | select(.vulnerability.severity=="Critical")'

4. Scan network services with OpenVAS / Greenbone

Greenbone Community Edition (formerly OpenVAS) is a full network vulnerability scanner. Heavier to set up but covers network-level CVEs that web-only scanners miss.

Greenbone / OpenVAS Free Network scan

Quickest way to run it is via Docker:

docker run -d -p 9392:9392 --name openvas greenbone/community-edition
# Wait ~10 minutes for feeds to sync, then open:
# https://localhost:9392  (admin / admin)

Or install on Debian/Ubuntu:

sudo apt install gvm
sudo gvm-setup
sudo gvm-start
# Open https://localhost:9392

Warning: Network scanners send real exploit probes. Only scan infrastructure you own or have written permission to test. Running these against third-party services without authorization is illegal.

5. Check specific CVEs against your OS packages

If you know a CVE from vulnfeed and want to quickly check if your system is affected:

Debian / Ubuntu Built-in

# Check if a package version is affected
apt-cache policy <package-name>

# Full security audit with debsecan
sudo apt install debsecan
debsecan --suite $(lsb_release -cs) --format detail | grep CVE-2024-1234

# Or use unattended-upgrades to auto-apply security patches:
sudo unattended-upgrade --dry-run -d

RHEL / CentOS / Rocky / AlmaLinux Built-in

# Check for a specific CVE
dnf updateinfo list --cve CVE-2024-1234

# List all available security updates
dnf updateinfo list security

# Apply security updates only
sudo dnf upgrade --security

6. Automate: daily CVE checks in CI

Add CVE scanning to your CI pipeline so every image build is checked before deployment:

GitHub Actions example CI/CD

name: CVE Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          severity: CRITICAL,HIGH
          exit-code: 1        # fail the build if found

Recommended workflow

Subscribe to vulnfeed weekly digest to get notified of new critical CVEs.
When you see a relevant CVE, check if a Nuclei template exists and run it against your endpoints.
Run trivy image on every container build in CI — fail on CRITICAL.
Run a weekly nuclei -tags cve -severity critical,high sweep against your public-facing services.
Subscribe to your distro's security mailing list (Ubuntu USN, Debian DSA, RHEL RHSA) for OS-level patches.