CVE Scanning

CVE Scanning

secwatch scans the host's OS packages and any running container images for known vulnerabilities, and highlights the ones actively exploited in the wild (on the CISA Known Exploited Vulnerabilities list).

How it works

• Host OS scan (no Docker needed) — uses a self-installed Trivy binary to scan the machine's installed OS packages (trivy rootfs). This is what makes CVE awareness useful on every node, not just Docker hosts.
• Container scan (when Docker is present) — Trivy-scans your running images.
• By default only fixable HIGH/CRITICAL CVEs are reported (cve.ignore_unfixed) — an OS lists thousands of will-not-fix CVEs that just bury the ones you can act on. Set it false for the full compliance-style list.
• Findings are cross-referenced against the CISA KEV feed; KEV-listed ones raise alerts (actively exploited → patch first), the rest are informational.
• Results appear in the dashboard's Vulnerabilities view and at GET /api/vulnerabilities.

Enable

cve:
  enabled: true
  scan_host: true                 # scan the host OS (Trivy binary; no Docker)
  ignore_unfixed: true            # only CVEs that have a fix available
  severities: HIGH,CRITICAL

No Docker required for the host scan — secwatch fetches a small Trivy binary on first use. Docker is only needed for the container image scan; without it, host scanning still runs.

Scheduling

Scans run on an interval (default once every 24h; SECWATCH_CVE_INTERVAL seconds), after a short delay at startup so a fresh boot isn't hammered. The KEV feed is cached and refreshed periodically.

Reading the results

• KEV findings are shown first — these are the ones to patch now, because attackers are known to be using them.
• By image gives you a per-image count of findings, criticals, and KEV hits so you know which image to rebuild first.

secwatch flags vulnerabilities — it doesn't patch them. Rebuild/upgrade the affected images to clear findings.