- Home
- Software Composition Analysis Software
- CVE Binary Tool
On the recordRead 9 Oct 202614 facts
CVE Binary Tool
Plans and prices
Free and open source
Free
No paid plans stated
Read 9 Oct 2026 · github.com
On the record
- Binary scanning
- The README describes 451 checkers for detecting components in binaries.github.com · read 9 Oct 2026
- Data refresh
- Vulnerability data is downloaded once per day by default, rather than for every scan.github.com · read 9 Oct 2026
- Inputs
- It can scan binaries, component lists, language package lists, and SBOMs.github.com · read 9 Oct 2026
- Install requirements
- It can be installed with pip, and some file extraction methods require additional system libraries; the documentation lists requirements for Linux and Windows.github.com · read 9 Oct 2026
- Integration
- The project provides an official GitHub Action for using the tool in GitHub Actions pipelines.github.com · read 9 Oct 2026
- Intended users
- The project describes CI use for regular vulnerability scans and early warning of known supply-chain issues, and also mentions component detection and SBOM creation.github.com · read 9 Oct 2026
- Offline use
- The tool supports offline scans if users first obtain a copy of the vulnerability data.github.com · read 9 Oct 2026
- PDF limitation
- PDF reporting requires the separately installed ReportLab library because it is excluded from the default installation due to a known CVE.github.com · read 9 Oct 2026
- Purpose
- CVE Binary Tool scans software to identify known vulnerabilities in detected or listed components.github.com · read 9 Oct 2026
- Reports
- Supported report formats include console, CSV, JSON, JSON2, HTML, and PDF.github.com · read 9 Oct 2026
- SBOMs
- It can scan SPDX, CycloneDX, and SWID SBOMs and generate SPDX or CycloneDX SBOMs.github.com · read 9 Oct 2026
- Security updates
- Security updates are made for the latest version; older versions are not supported because their NVD update mechanisms are often outdated.github.com · read 9 Oct 2026
- VEX
- It can generate or use VEX data in CSAF, CycloneDX, and OpenVEX formats for vulnerability triage.github.com · read 9 Oct 2026
- Vulnerability data
- The tool uses vulnerability data from NVD, Red Hat, OSV, GitLab Advisory Database, and Curl.github.com · read 9 Oct 2026
