Self-hosted · Agentless · AGPL-3.0
Agentless CVE scanning and fleet remediation for Linux hosts, over SSH.
Findings are ranked by what is being exploited, not just by what scores highest. When CveDeck doesn't know something, it tells you it doesn't know.
How it works
-
KEV → EPSS → CVSS
Prioritisation
Known exploitation outranks theoretical severity, so a fleet's hundreds of Highs sort into the few that matter this week. How findings are ranked -
Partial
Honest reporting
A scan whose data source failed is partial, never clean, and it resolves nothing. Unchecked exploitation status is unknown, never "not exploited". What a result really means -
Linux over SSH
Distributions
Debian, Ubuntu, RHEL and derivatives, Alpine, openSUSE and more, matched against each distribution's own advisories. Supported distributions -
Self-hosted
Self-host
One published container image, one port, one data directory, with login built in. Includes a demo mode with a fictional fleet and scanning disabled. Run it yourself
Limits, stated plainly
Linux only
Windows hosts can be discovered and enrolled, but scans are refused, because Windows inventory can't be matched against vulnerability data yet. A scan would finish with no findings, and that would look like a clean host.
You stay in control
CveDeck never runs commands on your hosts. Upgrade commands are generated for you to review, and nothing is remediated automatically. Scans are started by you: the only thing on a schedule is the threat-intel refresh, which downloads published feeds and touches none of your machines.
One account, and bring your own TLS
Login is on from the first start, with no default password, but there's a single account with no roles. CveDeck doesn't serve HTTPS itself, so put a TLS reverse proxy in front before exposing it beyond a network you trust. Read the security notes.