Skip to content
SPECIFICTION
Get listed

CVE Binary Tool

github.com

Free plan WindowsLinuxSelf-hosted
Visit github.com
Spec score 8.0 #19 of 65 in Software Composition Analysis Software

Spec sheet

Purpose
CVE Binary Tool scans software to identify known vulnerabilities in detected or listed components.Read 9 Oct 2026 · github.com
Intended users
The project describes CI use for regular vulnerability scans and early warning of known supply-chain issues, and also mentions component detection and SBOM creation.Read 9 Oct 2026 · github.com
Binary scanning
The README describes 451 checkers for detecting components in binaries.Read 9 Oct 2026 · github.com
Data refresh
Vulnerability data is downloaded once per day by default, rather than for every scan.Read 9 Oct 2026 · github.com
Inputs
It can scan binaries, component lists, language package lists, and SBOMs.Read 9 Oct 2026 · github.com
Install requirements
It can be installed with pip, and some file extraction methods require additional system libraries; the documentation lists requirements for Linux and Windows.Read 9 Oct 2026 · github.com
Integration
The project provides an official GitHub Action for using the tool in GitHub Actions pipelines.Read 9 Oct 2026 · github.com
Offline use
The tool supports offline scans if users first obtain a copy of the vulnerability data.Read 9 Oct 2026 · github.com
PDF limitation
PDF reporting requires the separately installed ReportLab library because it is excluded from the default installation due to a known CVE.Read 9 Oct 2026 · github.com
Reports
Supported report formats include console, CSV, JSON, JSON2, HTML, and PDF.Read 9 Oct 2026 · github.com
SBOMs
It can scan SPDX, CycloneDX, and SWID SBOMs and generate SPDX or CycloneDX SBOMs.Read 9 Oct 2026 · github.com
Security updates
Security updates are made for the latest version; older versions are not supported because their NVD update mechanisms are often outdated.Read 9 Oct 2026 · github.com
VEX
It can generate or use VEX data in CSAF, CycloneDX, and OpenVEX formats for vulnerability triage.Read 9 Oct 2026 · github.com
Vulnerability data
The tool uses vulnerability data from NVD, Red Hat, OSV, GitLab Advisory Database, and Curl.Read 9 Oct 2026 · github.com

Plans and prices

Free and open source Free No paid plans stated Read 9 Oct 2026 · github.com

Every CVE Binary Tool plan and price →

Where Specifiction places it

Alternatives to CVE Binary ToolAll alternatives →