heretixOne CVE inventory for servers, containers, and the appliances you can’t scan.
heretix tracks known vulnerabilities on firewalls and VPN gateways by matching vendor advisories against inventory, with no active scanning of the device. The same inventory also covers OS packages, containers, and language dependencies. Apache-2.0, self-hosted.
What heretix tracks
One inventory, matched against each vendor’s own advisories, with no agent or active scan running on the device itself.
Firewalls, VPN gateways, and security appliances from Fortinet, Palo Alto Networks, Cisco, Sophos, SonicWall, Broadcom/VMware, Check Point, Ivanti, and Citrix NetScaler.
RHEL (including RHEL 10), AlmaLinux, Rocky Linux, Oracle Linux, Debian, Ubuntu, and Alpine, matched against distro-specific advisory feeds. Windows Server 2016 to 2025 (beta), matched by OS build against Microsoft’s security updates.
Apache HTTP Server, Apache Tomcat, nginx, Zabbix, Splunk, and Oracle products (WebLogic, Java SE, MySQL, E-Business Suite, and more via Oracle CPU).
npm/yarn/pnpm, PyPI, Go modules (and statically linked Go binaries), Composer, Maven, Gradle, and Java archives (JAR/WAR/EAR).
Scan a Docker image directly, including the FROM base image chain from a Dockerfile.
For vendors with no dedicated fetcher above, heretix ingests the affected products and version ranges vendors themselves declare in every published CVE Record from the CVE Program, so coverage isn’t limited to the vendors listed here.
Detect attacks, not just CVEs
CVE scanners only tell you about known vulnerabilities. heretix-cli also detects active supply-chain attacks locally, with no API and no network required, so you can gate them in CI before they ship.
GlassWorm
Invisible / zero-width Unicode characters injected into source to hide malicious code from human review.
Dependency Confusion
Substitution and "Shai-Hulud"-style attacks where a public package shadows your private one.
Malicious Install Scripts
Dangerous commands hidden in npm lifecycle hooks and Python setup.py that run on install.
CI/CD Pipeline Poisoning
Suspicious patterns in GitHub Actions, GitLab CI, Jenkins, and other pipeline definitions.
Lock File Integrity
Weak hashes, missing signatures, and manifest/lockfile drift that signal tampering.
What is heretix?
heretix is an open-source vulnerability management platform composed of three components: a CLI scanner, a vulnerability data API, and a web management console. Together they provide a complete workflow, from scanning your infrastructure to detecting supply-chain attacks to tracking remediation.
How It Works
Components
heretix-cli
A command-line tool that scans Linux servers, Windows hosts, and Docker images for installed packages and asks heretix-api which of them have known vulnerabilities. It also runs the supply-chain checks offline (detect), exports a CycloneDX SBOM, and fails a CI job through its exit codes (0/1/2).
heretix-api
A REST API that gathers NVD, OSV, CISA KEV, EPSS, CVE Records, and vendor PSIRT advisories into one searchable database. Each finding comes with the version that fixes it, or the reason there is none. It also serves CPE and batch lookups and a product catalog.
heretix-management
A web console for asset inventory, alert triage, and remediation. Import CycloneDX SBOMs from heretix-cli, Trivy, or Syft, or register devices by hand, then work through fixes with SLA due dates, VEX, and a dependency graph.
See it in action
A full management console: dashboards, asset inventory, alert triage, remediation by fix, and a dependency graph in one self-hosted app.
Key Features
Compared with Trivy on real hosts
One real host per distribution, given to heretix and to Trivy as the same package list. Every finding that only one tool reported was checked against the distribution’s own data, and the notes say what those findings are. Each is one host on one date, not a general detection rate.
The figures are from after fixing the heretix defects that each host’s first run turned up; the full comparisons describe them. A finding is one installed package and one CVE, and both tools count a kernel CVE once for every kernel package installed, so most of the large counts are kernel packages. A larger count is not better in itself.
- Only Trivy: 2 CVEs Red Hat publishes no VEX document for, and 1 that Red Hat lists as not affected.
- Only heretix: unfixed CVEs Red Hat records as deferred, affected or will not fix; Red Hat’s VEX data confirms 5,470 of the 5,471.
- Fixed versions agree on all 1,712 findings that have one.
- Only Trivy: Debian issues with no CVE number (TEMP-* and CVE-less DSAs), which OSV does not publish.
- Only heretix: 6,207 on the signed kernel and boot loaders, on which Trivy reports no finding; 6 Debian has not decided on, 6 from OSV records newer than Trivy’s database, and 4 false positives where OSV still lists a package the tracker has cleared.
- Fixed versions agree on all 734 findings that have one.
- Only heretix: 3,459 on the signed kernel image, on which Trivy reports no finding; 706 that Ubuntu has not triaged or will not fix; 4 security updates with no CVE number; 44 not verified.
- Fixed versions agree on all 6 findings that have one.
Quick Start
Stand up heretix-api and heretix-management with Docker Compose, load vulnerability data, then scan your first host with heretix-cli.
View the deploy guide