CVE Scanning

CVE Scanning

secwatch scans your running container images for known vulnerabilities and highlights the ones that are actively exploited in the wild (on the CISA Known Exploited Vulnerabilities list).

How it works

• Uses Trivy (run as a container) to scan the images of your running containers.
• Cross-references findings against the CISA KEV feed.
• KEV-listed findings raise alerts; the rest are informational.
• Results appear in the dashboard's Vulnerabilities card and at GET /api/vulnerabilities.

Enable

cve:
  enabled: true
  severities: HIGH,CRITICAL       # what to report
  trivy_image: aquasec/trivy:0.58.0

Requires Docker available to secwatch (to enumerate running images and run Trivy). Without Docker, CVE scanning simply idles — nothing breaks.

Scheduling

Scans run on an interval (default once every 24h; SECWATCH_CVE_INTERVAL seconds), after a short delay at startup so a fresh boot isn't hammered. The KEV feed is cached and refreshed periodically.

Reading the results

• KEV findings are shown first — these are the ones to patch now, because attackers are known to be using them.
• By image gives you a per-image count of findings, criticals, and KEV hits so you know which image to rebuild first.

secwatch flags vulnerabilities — it doesn't patch them. Rebuild/upgrade the affected images to clear findings.