vuls

An agentless vulnerability scanner for Linux servers: it connects over SSH, inventories installed packages, and reports which have known CVEs, with severity and available fixes. Agentless matters because it means nothing installed on the machines you are scanning. Go, GPL-3.0, from a Japanese engineering firm running it in production. The tradeoff is that it reports rather than fixes, and the raw output is noisy — a moderately old server produces hundreds of findings, most of which are not exploitable in your configuration. It needs someone willing to triage results into a real priority list, otherwise it becomes a report nobody reads.