Vulnerability intelligence for real servers

Stop reading CVE feeds.
Know what actually hits your servers.

Vulnraze matches NVD, CISA KEV, OSV, EPSS and vendor advisories against the exact software installed on your Linux and Windows hosts — then ranks every finding by real-world exploitation, so you patch what matters first.

Get started See it in action →
Cloud or self-hostedRead-only agentBackport-aware
Vulnraze security overview dashboard with affected findings, known exploited vulnerabilities and risk trend
Intelligence from
NIST NVDCISA KEVOSV.dev FIRST EPSSGitHub AdvisoriesCVE.org Red HatMicrosoft MSRCDebian · Ubuntu · Rocky DrupalNode.js
The problem

CVE feeds tell you what exists. Not what you run.

Thousands of CVEs are published every month. Most don't touch your servers — and the ones that do get buried under false alarms.

Typical scanners & feeds

  • Flag "Critical" on Debian or RHEL packages that the distribution already patched via backports.
  • Rank by CVSS alone — a 9.8 nobody exploits outranks a 7.5 that is attacked today.
  • Show a CVE list, not which server, which package and which fixed version.
  • Lose history: you never know when a finding appeared or when it was fixed.

With Vulnraze

  • Distribution advisories compared with exact package versions (dpkg, RPM EVR). Upstream-only matches are marked Unknown, never a false Critical.
  • Exploit-first priority: CISA KEV, EPSS, exposure and asset criticality — with every point explained.
  • Every finding names the server, package, installed version and the version that fixes it.
  • Full finding history: detected, confirmed, fixed, reopened — with time-to-fix.
Capabilities

Everything you need to stay ahead of exploitation

Backport-aware matching

Debian, Ubuntu, RHEL, Rocky and AlmaLinux advisories are matched by source package and distribution version comparison — not string matching.

Exploit-first priority

Emergency, Urgent, High — driven by CISA KEV, EPSS probability, internet exposure and asset criticality. Emergency requires confirmed exploitation.

Lightweight agent

A ~6 MB static binary for Linux and Windows. Reads packages, OS facts and well-known app versions. Outbound HTTPS only, no open ports.

Finding history & SLAs

See when each CVE was detected and fixed on every server, with version changes, remediation owners, deadlines and overdue tracking.

Alerts where you work

Slack, Telegram, e-mail and signed webhooks. Deduplicated, coalesced per CVE, with quiet hours and daily or weekly digests.

Built for multiple customers

Group servers per customer, route each customer's alerts to their own channel and give them a read-only portal that shows only their servers.

Product tour

From thousands of CVEs to a short, ranked to-do list

Real screens from a running Vulnraze instance.

Vulnerability explorer listing CVEs per server with CVSS, severity, business priority and CISA KEV badges
Every finding on every server — filter by KEV, EPSS, priority, environment or customer, and export what you see.
How it works

Running in under 15 minutes

Choose Cloud or self-hosted

Start on Vulnraze Cloud in a couple of clicks, or let our team set Vulnraze up inside your own infrastructure.

✓ Workspace ready

Enroll your servers

Connect each server with a lightweight agent in about a minute — or add software by hand for hosts you can't install on.

✓ web-01 connected · inventory received

Get prioritized alerts

Sources sync automatically. New exploited CVEs on your servers reach Slack or Telegram within minutes.

⚑ EMERGENCY CVE-… on web-01 (KEV)
Security by design

A security tool you don't have to worry about

Your software inventory is a map of your attack surface. Vulnraze gives the agent as little power as possible — and with self-hosting, the data never leaves your infrastructure.

The agent only reads inventory. It never runs commands from the server, opens no ports, installs nothing and collects no secrets.

Self-hosting option

Run it in-house: inventory and findings stay in your database; only public advisory feeds are fetched.

No remote execution

No remote shell, no arbitrary commands, no auto-patching — by design, not by setting.

Single-use enrollment

Short-lived tokens stored only as hashes; per-agent credentials with rotation and instant revocation.

Strong authentication

Argon2id passwords, TOTP MFA, role-based access, CSRF protection and account lockout.

Encrypted secrets

Notification credentials and MFA secrets are encrypted at rest. No default admin password.

Hardened runtime

Non-root, read-only containers; database and cache on an internal network; SSRF-guarded fetchers.

For MSPs & hosting providers

One console. Every customer. Strict separation.

  • Group servers per customer; new agents join the right customer automatically.
  • Each customer's alerts go to their own Slack, Telegram or e-mail — listing only their servers.
  • Read-only customer logins that see only their own servers, findings and reports.
  • Per-customer dashboards and PDF reports for monthly reviews.
Customer groups overview
Pricing

Simple pricing, two ways to run it

Vulnraze Cloud is hosted and updated by us. Prefer to keep everything in-house? Run it self-hosted with a license key. Every plan includes all intelligence sources and the agent for Linux and Windows.

Starter
€10 / month

For a handful of servers.

  • Up to 5 servers
  • All intelligence sources
  • E-mail & webhook alerts
  • Finding history
  • E-mail support
Choose Starter
Pro Most popular
€49 / month

For teams that run production infrastructure.

  • Up to 25 servers
  • Slack, Telegram, e-mail, webhooks
  • Finding history, SLAs & reports
  • MFA, roles & audit log
  • E-mail support
Choose Pro
MSP
€199 / month

For providers managing many customers.

  • Unlimited servers
  • Customer groups & alert routing
  • Read-only customer portals
  • Per-customer reports
  • Priority support
Choose MSP

Vulnraze Cloud, billed monthly. Prices exclude VAT.

Self-hosted

Run Vulnraze on your own infrastructure

Your inventory and findings never leave your network. Licensed per number of servers and term, with updates and support included.

  • License key for your server count and term
  • Guided installation by our team
  • Only outbound access to public advisory feeds is needed
  • Onboarding and priority support
Contact sales Pricing for your server count and term.
FAQ

Questions, answered

Is Vulnraze SaaS or self-hosted?

Both. Vulnraze Cloud is hosted and updated by us — you only install the agent on your servers. Self-hosted runs on your own server under a license key, so your inventory and findings never leave your infrastructure; contact sales for a license.

Which systems does the agent support?

Linux with rpm or dpkg (RHEL, Rocky, AlmaLinux, Debian, Ubuntu) and Windows Server 2016+ / Windows 10+. Hosts without an agent can be added manually or imported from CSV/JSON.

How do you avoid false positives on Debian or RHEL?

Distributions backport security fixes without changing the upstream version. Vulnraze compares the installed package with the distribution's own advisories using dpkg and RPM version rules. A match based only on upstream version data is shown as Unknown and can never trigger an Emergency alert.

Does Vulnraze patch my servers?

No. It tells you exactly what is affected and which version fixes it. The agent is read-only by design: no remote commands, no automatic patching.

Does the agent need inbound ports or a VPN?

No. The agent only makes outbound HTTPS requests to Vulnraze (Cloud or your own server) and keeps working offline with a local queue.

Can my customers see their own servers?

Yes. Create a read-only customer login linked to their group. They see only their servers, findings and reports — never other customers or your internal notes.

See what really affects your servers.

Deploy Vulnraze in minutes and get a ranked list of the vulnerabilities that matter on your infrastructure.

Get started Talk to us
Find vulnerabilities. Secure what matters.