# ossf/cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

Repository: https://github.com/ossf/cve-bin-tool
Canonical: https://ross.abutalabs.com/products/cve-bin-tool
Homepage: https://cve-bin-tool.readthedocs.io/en/latest/
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: cve, security, hacktoberfest, vulnerabilities, cvss, swrepo, system-tools, devsecops, security-automation, security-tools, python, sbom, vulnerability, sbom-tool
Last push: 2026-08-26T11:49:28+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 8, longevity 100
- inputs: {"age_days": 2791, "days_push": 7, "days_rel": 715, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1753, forks 645 (observed 2026-08-28T04:05:31.722352+00:00)

## What it is
A Python CLI tool that scans binaries and systems for known CVEs in over 350 common open-source components like openssl, libpng, and expat. It can also check vulnerabilities for components listed in an SBOM or a component/version list.

## Use cases
- scan a linux system for binaries with known cves
- check if my firmware bundles vulnerable openssl versions
- find cves from an sbom file
- audit third-party libraries in a docker image for vulnerabilities
- generate a vulnerability report for a list of components and versions
- integrate cve scanning into ci pipeline

## When to choose
- you need to detect known CVEs in compiled binaries or extracted filesystems without source access
- you want an SBOM-based vulnerability check or triage of vulnerable components
- you want a free, scriptable, offline-capable scanner for CI/CD or devsecops workflows

## When to avoid
- you need dynamic or runtime exploit detection rather than known-CVE matching
- you need full SCA for interpreted-language dependency trees (use a package-level SCA tool)
- you require commercial support or guaranteed SLAs

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, cli, developer-tools
- domain: security, developer-tools
- platform: windows, python, cli, cross-platform
- tags: cve, sbom, binary-analysis, devsecops, vulnerability-database, supply-chain-security, devops, linux, macos

## Member repositories
- ossf/cve-bin-tool (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:31.722352+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:28:14.497476+00:00, confidence not recorded.
  - readme: https://github.com/ossf/cve-bin-tool (fetched 2026-08-28T04:05:31.722352+00:00, sha a0842ea73f3a)
- Data as of 2026-08-30T08:39:29.467469+00:00.