heretixOne CVE inventory for servers, containers, and the appliances you can’t scan.
heretix tracks known vulnerabilities on firewalls and VPN gateways by matching vendor advisories against inventory, with no active scanning of the device. The same inventory also covers OS packages, containers, and language dependencies. Apache-2.0, self-hosted.
What heretix tracks
One inventory, matched against each vendor’s own advisories, with no agent or active scan running on the device itself.
Firewalls, VPN gateways, and security appliances from Fortinet, Palo Alto Networks, Cisco, Sophos, SonicWall, Broadcom/VMware, and Check Point.
RHEL, AlmaLinux, Rocky Linux, Oracle Linux, Debian, Ubuntu, and Alpine, matched against distro-specific advisory feeds.
Apache HTTP Server, Apache Tomcat, nginx, Zabbix, Splunk, and Oracle products (WebLogic, Java SE, MySQL, E-Business Suite, and more via Oracle CPU).
npm/yarn/pnpm, PyPI, Go modules (and statically linked Go binaries), Composer, Maven, Gradle, and Java archives (JAR/WAR/EAR).
Scan a Docker image directly, including the FROM base image chain from a Dockerfile.
For vendors with no dedicated fetcher above, heretix ingests the affected products and version ranges vendors themselves declare in every published CVE Record from the CVE Program, so coverage isn’t limited to the vendors listed here.
Detect attacks, not just CVEs
CVE scanners only tell you about known vulnerabilities. heretix-cli also detects active supply-chain attacks locally, with no API and no network required, so you can gate them in CI before they ship.
GlassWorm
Invisible / zero-width Unicode characters injected into source to hide malicious code from human review.
Dependency Confusion
Substitution and "Shai-Hulud"-style attacks where a public package shadows your private one.
Malicious Install Scripts
Dangerous commands hidden in npm lifecycle hooks and Python setup.py that run on install.
CI/CD Pipeline Poisoning
Suspicious patterns in GitHub Actions, GitLab CI, Jenkins, and other pipeline definitions.
Hardcoded Secrets
Credentials and API keys committed into source and configuration files.
Lock File Integrity
Weak hashes, missing signatures, and manifest/lockfile drift that signal tampering.
What is heretix?
heretix is an open-source vulnerability management platform composed of three components: a CLI scanner, a vulnerability data API, and a web management console. Together they provide a complete workflow, from scanning your infrastructure to detecting supply-chain attacks to tracking remediation.
How It Works
Components
heretix-cli
A command-line tool that scans Linux servers, Windows hosts, and Docker images for installed packages across RPM, DPKG, Alpine/APK, npm/yarn/pnpm, PyPI (from actual `site-packages` installs, not just lockfiles), Go modules (plus modules statically linked into a compiled binary), Composer, Maven, Gradle, and Java archives (JAR/WAR/EAR), then queries heretix-api for known vulnerabilities. Findings are collapsed per source package, and kernel-header/build-toolchain packages are tagged separately; on one measured image, `--runtime-only` cut findings from 1485 to 721 to 267. Supports Docker registry authentication (ECR, GCR, Docker Hub) and Dockerfile base image chain scanning. Performs local supply-chain security checks (GlassWorm, Dependency Confusion, Malicious Install Scripts, CI/CD Pipeline Poisoning, Hardcoded Secrets, Lock File Integrity) without API access. Run them anytime with the offline `detect` command (beta). Exports CycloneDX SBOM with a full dependency tree, package integrity hashes, and distro-qualified PURLs, and submits inventory to the GitHub Dependency Submission API. Structured exit codes (0/1/2) for CI/CD integration.
heretix-api
A REST API that aggregates and normalizes vulnerability data from NVD, OSV, CISA KEV, EPSS, and every published CVE Record, including CNA-declared affected products and CISA Vulnrichment’s SSVC assessment (exploitation state, automatability, technical impact; final priority scoring is left to you). Vendor PSIRT advisories cover Fortinet, Palo Alto Networks, Cisco, Sophos, SonicWall, Broadcom/VMware, Check Point, Red Hat, Oracle Linux, Oracle CPU, Splunk, Apache HTTP Server, Apache Tomcat, nginx, and Zabbix. Search results report the fixed version for each finding, alongside CPE 2.3 and batch lookup endpoints.
heretix-management
A web console for end-to-end vulnerability management. Import heretix-cli inventory JSON or CycloneDX SBOMs, register network devices and firewalls manually, and manage software packages outside package managers with CPE and vendor advisory support. Features include: an interactive dependency graph (beta) with direct/indirect classification, VEX document export/import (beta, CycloneDX), configurable SLA due dates by severity with a fixed override for CISA KEV, alert timeline with automatic event recording, fixed-version display, bulk status updates, CSV/JSON export, vulnerability search by package/CVE/CPE/advisory, metadata refresh to pull the latest CVSS/EPSS/KEV data, scheduled daily jobs, user management with admin/operator roles, an admin-only audit log, and structured JSON logging.
See it in action
A full management console: dashboards, asset inventory, and alert triage in one self-hosted app.
Key Features
Quick Start
Stand up heretix-api and heretix-management with Docker Compose, load vulnerability data, then scan your first host with heretix-cli.
View the deploy guide