vuls is an agent-less, Go-based vulnerability scanner that correlates OS package inventories against NVD, OVAL and CISA KEV feeds for authorized asset owners and defenders.

vuls, hosted at future-architect/vuls and licensed under GPL-3.0, attacks one of the most persistent operational problems in infrastructure security: the daily grind of reconciling newly published CVEs against everything installed across a fleet. The README frames the problem precisely — administrators who disable automatic updates to protect production uptime must then manually track NVD, figure out which of possibly hundreds of packages are affected, and determine which servers need patching. Human-driven analysis of that scale inevitably misses servers. vuls automates the detection loop so oversight becomes a structural impossibility rather than a discipline problem.

What makes vuls notable architecturally is that it is agent-less. In remote scan mode you stand up a single machine that reaches target servers over SSH, collects the software inventory, and matches it locally against vulnerability data. There is nothing to install or maintain on the targets, which is why the project emphasizes nondestructive testing and near-zero load on scanned hosts. For teams that dislike the central-server-to-SSH topology, local scan mode runs directly on each host, and server mode inverts the model entirely: vuls listens as an HTTP server, targets run a set of Linux commands themselves and POST the collected software information back, receiving scan results as JSON — no SSH, no scanner binary on the target.

The scan modes are tiered by privilege. Fast Scan runs without root privileges and with no dependencies, and supports an offline mode for air-gapped or restricted-network environments on distributions including CentOS, AlmaLinux, Rocky Linux, Debian, Oracle Linux, RHEL, Fedora and Ubuntu. Fast Root Scan escalates to root to enable the more interesting dynamic checks: on RPM-family systems it uses yum-ps to detect which running processes are affected by a pending update, and on Debian and Ubuntu it leverages checkrestart from debian-goodies to flag processes using old libraries that were updated but never restarted. This restart-detection is where vuls crosses from static inventory matching into genuinely useful operational intelligence — a patched-but-unrestarted kernel or daemon is still exploitable, and vuls warns about exactly that.

The breadth of the correlation corpus is the tool's core strength. Beyond NVD and the Japanese JVN database, it consumes OVAL feeds from Red Hat, Debian, Ubuntu, SUSE and Oracle Linux, distribution security trackers for Alpine, Debian and Ubuntu, Microsoft CVRF data for Windows, and distribution advisory channels surfaced through native commands like yum, zypper and pkg-audit. This multi-source approach matters because NVD alone is notoriously slow and incomplete for distribution-specific backports; vendor OVAL data is what makes results accurate on RHEL-family systems where package versions do not map cleanly to upstream CVE records.

vuls also enriches findings with exploitability context, which is where a defender's triage gets most of its value. It cross-references the Exploit Database, Metasploit-Framework modules, community PoC collections such as qazbnm456/awesome-cve-poc, nomi-sec/PoC-in-GitHub and gmatuz/inthewilddb, plus projectdiscovery/nuclei-templates. On top of that it pulls CISA's Known Exploited Vulnerabilities catalog and the VulnCheck KEV variant, US-CERT and JPCERT alerts, and MITRE ATT&CK/CAPEC threat-intelligence mappings via mitre/cti. The practical effect is that a report distinguishes between a theoretical CVE and one with public weaponization, letting patching priority follow actual risk rather than raw CVSS.

Scope extends well beyond OS packages. vuls scans WordPress core, themes and plugins using the wpscan API — a genuinely useful inclusion given how often CMS plugin staleness is the actual breach vector. For programming-language dependencies it offers lockfile-based scanning, CPE-based scanning for self-compiled software, GitHub Security Alerts integration, and an experimental OWASP Dependency Check bridge. Network devices are listed among the non-OS scan targets as well. This turns vuls from a Linux patch auditor into something closer to a unified configuration-and-vulnerability inventory for a mixed estate, covering cloud instances, on-premise servers and running Docker containers.

Reporting and workflow integration are treated as first-class concerns rather than afterthoughts. Scan results are viewable in a terminal TUI viewer or in VulsRepo, a companion web UI for pivoting through findings over time. Email and Slack notifications are built in, and the README explicitly positions CRON-driven daily scans as the intended operating pattern, tying into continuous integration so vulnerabilities surface quickly after disclosure. There is also an auto-generation feature for configuration templates: vuls can auto-detect servers via CIDR ranges and emit a config skeleton, which removes the most tedious part of onboarding a fleet.

The deployment story on cloud is pragmatic. The README notes that no pre-authorization is necessary before scanning on AWS — a statement about agent-less inventory collection being read-only and non-intrusive, in contrast to tools that execute heavier probes. That said, professionals should still read this within the tool's design intent: vuls is built for scanning infrastructure you own or are contracted to administer, not third-party systems. The SSH-based remote mode in particular assumes legitimate administrative access to targets.

Equally important is what the README says vuls does not do: it does not update vulnerable packages. This is a detection and reporting tool, not a remediation engine. That boundary is worth appreciating — it keeps vuls out of the business of mutating production state, which aligns with its nondestructive philosophy and makes it safe to schedule aggressively. Patching remains a human or pipeline decision informed by the report's affected-process and restart-required warnings.

Written in Go with over twelve thousand stars, the project sits in the mature tier of open-source vulnerability tooling, maintained under future-architect with original authorship by kotakanbe and a substantial contributor base, plus sponsorship from Tines and SAKURA internet. Documentation lives at vuls.io with Japanese translations, covering installation, tutorials and per-mode architecture pages — a sign of a project that invests in operator onboarding rather than assuming expertise.

Installation is a standard Go fetch from source: go install github.com/future-architect/vuls@latest, after which the workflow is vuls config to generate and validate the target configuration, vuls scan to execute, and vuls tui or vuls report to review findings. Full setup instructions, including the companion goval-dict and gost data fetchers referenced from the docs, are maintained at vuls.io.

For an authorized defender, vuls occupies the same niche as OpenSCAP or Trivy's host-scanning mode but with a distinctly operations-first design: agent-less collection, restart-aware process detection, KEV-enriched prioritization, and CI-friendly scheduling. Run it daily against your own estate, feed the JSON output into your ticketing pipeline, and the 'did we miss a server' failure mode largely disappears.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.