CVE Binary Tool

What it does

Binary scanning

The README describes 451 checkers for detecting components in binaries.checked 9 Oct 2026

Data refresh

Vulnerability data is downloaded once per day by default, rather than for every scan.checked 9 Oct 2026

Inputs

It can scan binaries, component lists, language package lists, and SBOMs.checked 9 Oct 2026

Install requirements

It can be installed with pip, and some file extraction methods require additional system libraries; the documentation lists requirements for Linux and Windows.checked 9 Oct 2026

Integration

The project provides an official GitHub Action for using the tool in GitHub Actions pipelines.checked 9 Oct 2026

Intended users

The project describes CI use for regular vulnerability scans and early warning of known supply-chain issues, and also mentions component detection and SBOM creation.checked 9 Oct 2026

Offline use

The tool supports offline scans if users first obtain a copy of the vulnerability data.checked 9 Oct 2026

PDF limitation

PDF reporting requires the separately installed ReportLab library because it is excluded from the default installation due to a known CVE.checked 9 Oct 2026

Purpose

CVE Binary Tool scans software to identify known vulnerabilities in detected or listed components.checked 9 Oct 2026

Reports

Supported report formats include console, CSV, JSON, JSON2, HTML, and PDF.checked 9 Oct 2026

SBOMs

It can scan SPDX, CycloneDX, and SWID SBOMs and generate SPDX or CycloneDX SBOMs.checked 9 Oct 2026

Security updates

Security updates are made for the latest version; older versions are not supported because their NVD update mechanisms are often outdated.checked 9 Oct 2026

VEX

It can generate or use VEX data in CSAF, CycloneDX, and OpenVEX formats for vulnerability triage.checked 9 Oct 2026

Vulnerability data

The tool uses vulnerability data from NVD, Red Hat, OSV, GitLab Advisory Database, and Curl.checked 9 Oct 2026