vulncheck
f77c7413b3
The KEV panel knew CISA (~1400 CVEs) and ENISA EUVD. VulnCheck KEV carries
~5200 and typically lists them days before CISA does — every record ships
CISA's own date, so the lead time is measurable, not a claim, and each row
now shows it.
Opt-in and silent by default: without VULNCHECK_API_TOKEN the source returns
{} and nothing about the install changes. Alerting is deliberately NOT opted
in either — kev_alert_sources stays "cisa,euvd", because ~4x the CVEs is the
operator's decision, not a side effect of updating.
No SDK: two GETs against a documented JSON API. The backup endpoint hands out
the whole index as one signed ZIP; the paginated index is only the fallback
and is capped at 600 documents on the community tier, which the log says out
loud so a partial catalog is never mistaken for the full one.
Attribution is a licence term, not decoration: "VulnCheck KEV" is named in the
KEV panel header and badges every row the source contributed to. Noted in
LICENSING.md so nobody strips it later.
Per-vulnerability scoring is untouched — kev_listed still comes from CISA
alone. Feeding 5200 CVEs into the URS bonus would move every score in the
fleet and belongs in its own decision.
5.6 KiB
Licensing
TrueVuln is open core. This document is the authoritative statement of what is free and open source software and what is not. It is published alongside the first public release so the boundary is known up front and does not move under you.
Copyright (C) 2026 {{LICENSOR}}
The short version
| Everything in this repository | Free and open source under AGPL-3.0-or-later. Self-host it, modify it, run it in production, commercially, at no cost. |
| TrueVuln Enterprise | A separate, commercially licensed add-on. Not in this repository. Not required to run TrueVuln. |
There is no "crippled community edition". The entire detection and enrichment engine -- the part that actually does the work -- is AGPL and stays AGPL.
What is AGPL-3.0 (this repository)
The complete, production-usable vulnerability management platform:
Scanner and inventory integrations
- Wazuh (agent discovery, vulnerability sync, Syscollector triggers, patch verification)
- Tenable Nessus (scan import, launch/poll, VPR, exploit maturity)
- Microsoft Intune / Graph API (managed devices, detectedApps)
- Microsoft Defender for Endpoint TVM (per-device CVEs, software inventory)
- VMware vCenter / ESXi
Threat-intelligence enrichment
- EPSS, CISA KEV, ENISA EUVD, VulnCheck KEV (community, optional)
- Exploit-DB, PoC-in-GitHub, Metasploit module index
- cvelistV5, CISA Vulnrichment, NVD, GitHub Advisories (GHSA)
- Mozilla MFSA, MSRC, Ubuntu USN, Red Hat errata, OSV.dev
Detection engines
- End-of-life / end-of-support detection (endoflife.date + Microsoft product lifecycle)
- Microsoft 365 Apps CVE detection
- Windows OS CVE detection (client and server, build-range matched)
- SharePoint and modern .NET detection
- MSRC fixed-build scanning
- Mobile device security (Samsung SMR, Google ASB, Android patch-level staleness)
- App-to-CVE scanner for software with no dedicated scanner
- Security advisory feeds (CISA KEV, RSS sources)
Platform
- Priority and CPR risk scoring, SLA tracking and enforcement, email alerts
- Automated patch verification, deferral and false-positive workflows
- Full web UI and dashboard
- Local authentication with TOTP multi-factor authentication
- Role-based access control
- REST API
- CSV export
This is a complete product. A company can run it, rely on it, and never pay anything.
What is TrueVuln Enterprise (commercial)
Distributed separately under a commercial license, aimed at organisations with a regulatory driver and a compliance budget:
| Capability | Why it is here |
|---|---|
| Enterprise SSO -- LDAP / Active Directory, OIDC, SAML with JIT provisioning and role mapping | Needed only once identity is centrally governed |
| Revision-proof audit trail -- tamper-evident, exportable, retention-managed | Driven by audit and certification requirements |
| Compliance reporting -- PCI-DSS, ISO 27001, NIST 800-53, HIPAA control mapping, scoped PDF reports | Produced for auditors, not for operators |
| SIEM forwarding -- syslog / CEF export to external SIEM | Enterprise integration surface |
| Multi-tenancy -- mandant separation for MSPs and holding structures | Only meaningful above single-organisation scale |
| Priority support with SLA | Commercial obligation, not code |
The rule we hold ourselves to
A feature belongs in Enterprise only if both are true:
- It is not needed to detect, prioritise, or remediate a vulnerability.
- The organisations that need it have a compliance or scale driver, and therefore a budget.
Anything that makes TrueVuln better at its actual job -- finding real vulnerabilities on real assets -- goes into the AGPL core. We will not move an existing AGPL feature into Enterprise. New Enterprise features are additive.
Why AGPL-3.0
AGPL is a strong copyleft licence with a network clause. Anyone who modifies TrueVuln and offers it to third parties over a network must publish their modifications.
For you as a user, this means nothing changes: self-hosting TrueVuln inside your own organisation, including commercially, triggers no obligation to publish anything. The network clause applies to offering the software as a service to others.
For us, it means a cloud provider cannot take this work, run it as a paid service, and give nothing back.
Commercial licence exemption
If AGPL-3.0 is incompatible with your intended use -- typically because you want to embed TrueVuln in a proprietary product or offer it as a hosted service without publishing your modifications -- a commercial licence is available. Contact: {{CONTACT}}
Contributing
Contributions to this repository are accepted under the Contributor License Agreement. The CLA lets us offer TrueVuln under both AGPL and commercial terms. You keep the copyright to your work. See CONTRIBUTING.md.
Trademark
"TrueVuln" and the TrueVuln logo are trademarks of {{LICENSOR}}. The AGPL grants rights to the code, not to the name. You may state that your product is built on or derived from TrueVuln. You may not use the name or logo in a way that suggests your fork is the official distribution.
SPDX
SPDX-License-Identifier: AGPL-3.0-or-later
Data source attribution
VulnCheck KEV — when the VulnCheck KEV source is enabled (optional, off
without VULNCHECK_API_TOKEN), its data is free to use in commercial and
open-source products on one condition: prominent attribution. The Advisories
page therefore names "VulnCheck KEV" in the KEV panel header and badges every
row the source contributed to. Do not remove that labelling while the source
is enabled — it is the licence term, not decoration.
https://docs.vulncheck.com/community/vulncheck-kev/attribution