Freedom251 › Software Composition Analysis Software
CVE Binary Tool
What CVE Binary Tool is
CVE Binary Tool is a free, self-hosted utility for finding known vulnerabilities in software components. It scans binaries, component lists, language package lists, and SBOMs, with 451 checkers described for binary component detection. Supported ecosystems include Dart, Go, Java, JavaScript, OpenWrt, Perl, Python, Rust, Ruby, R, and Swift. It reads SPDX, CycloneDX, and SWID SBOMs and can generate SPDX or CycloneDX files. VEX data can be created or used in CSAF, CycloneDX, and OpenVEX formats. Vulnerability information comes from NVD, Red Hat, OSV, GitLab Advisory Database, and Curl. Reports can use console, CSV, JSON, JSON2, HTML, or PDF formats. An official GitHub Action supports pipeline use and pull-request scanning. Offline scans work after vulnerability data is obtained. Installation uses pip; some extraction methods need extra system libraries.
Who it suits
CVE Binary Tool suits teams performing recurring CI vulnerability scans, component detection, SBOM creation, and supply-chain checks. It is intended for Linux, Windows, or self-hosted environments.
What it does well
- Scans binaries and multiple package-list formats
- Supports 451 binary component checkers
- Generates SPDX and CycloneDX SBOMs
- Creates or uses VEX data
- Provides an official GitHub Action
What to know first
- PDF reports require separately installed ReportLab
- Some extraction methods need system libraries
- Older versions are not supported
- Vulnerability data refreshes once daily by default
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free and open source | No paid plans stated | Free |
As github.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Verdict
CVE Binary Tool offers broad input, ecosystem, SBOM, VEX, and reporting support at no listed cost. Its self-hosted setup and installation requirements matter when planning deployment.
Facts from CVE Binary Tool's own pages
- Binary scanning
- The README describes 451 checkers for detecting components in binaries. · github.com, 9 Oct 2026
- Data refresh
- Vulnerability data is downloaded once per day by default, rather than for every scan. · github.com, 9 Oct 2026
- Inputs
- It can scan binaries, component lists, language package lists, and SBOMs. · github.com, 9 Oct 2026
- Install requirements
- It can be installed with pip, and some file extraction methods require additional system libraries; the documentation lists requirements for Linux and Windows. · github.com, 9 Oct 2026
- Integration
- The project provides an official GitHub Action for using the tool in GitHub Actions pipelines. · github.com, 9 Oct 2026
- Intended users
- The project describes CI use for regular vulnerability scans and early warning of known supply-chain issues, and also mentions component detection and SBOM creation. · github.com, 9 Oct 2026
- Offline use
- The tool supports offline scans if users first obtain a copy of the vulnerability data. · github.com, 9 Oct 2026
- PDF limitation
- PDF reporting requires the separately installed ReportLab library because it is excluded from the default installation due to a known CVE. · github.com, 9 Oct 2026
- Purpose
- CVE Binary Tool scans software to identify known vulnerabilities in detected or listed components. · github.com, 9 Oct 2026
- Reports
- Supported report formats include console, CSV, JSON, JSON2, HTML, and PDF. · github.com, 9 Oct 2026
- SBOMs
- It can scan SPDX, CycloneDX, and SWID SBOMs and generate SPDX or CycloneDX SBOMs. · github.com, 9 Oct 2026
- Security updates
- Security updates are made for the latest version; older versions are not supported because their NVD update mechanisms are often outdated. · github.com, 9 Oct 2026
- VEX
- It can generate or use VEX data in CSAF, CycloneDX, and OpenVEX formats for vulnerability triage. · github.com, 9 Oct 2026
- Vulnerability data
- The tool uses vulnerability data from NVD, Red Hat, OSV, GitLab Advisory Database, and Curl. · github.com, 9 Oct 2026