Vuls is an agent-less vulnerability scanner written in Go and licensed under GPL-3.0, aimed at system administrators and security teams that must find and track known vulnerabilities across Linux, FreeBSD, Windows and macOS hosts, containers, WordPress installs, programming language libraries and network devices without installing an agent on every machine.

What it is

Vuls is a vulnerability scanner maintained by future-architect, distributed as a Go project under the GPL-3.0 licence, with 12,263 stars, 1,243 forks, 92 open issues and a last push on 2026-09-18. Its documentation and project home live at vuls.io. It targets the system administration and cybersecurity ecosystem, sits alongside the topics security-audit, security-automation, security-hardening and security-scanner, and describes itself as agent-less, meaning the hosts it examines do not need an agent installed and maintained on them.

The concrete problem it solves is the daily burden of vulnerability analysis and software updates. In production environments it is common for an administrator to disable the package manager's automatic update option to avoid downtime and to apply updates manually instead. That choice creates three problems that Vuls exists to remove: the administrator must constantly watch NVD and comparable databases for new vulnerabilities; monitoring every installed package becomes impossible when a server carries a large number of them; and determining which servers a newly announced vulnerability affects is expensive, with the real risk of overlooking one or two machines. Vuls replaces that manual, easily-incomplete cross-referencing with automated detection, telling users both which vulnerabilities relate to their systems and which servers are affected, and producing a report on a regular schedule through CRON or a similar scheduler.

Key capabilities

• Scans major Linux distributions including Alpine, Amazon Linux, CentOS, AlmaLinux, Rocky Linux, Debian, Oracle Linux, Raspbian, RHEL, openSUSE, openSUSE Leap, SUSE Enterprise Linux, Fedora and Ubuntu, plus FreeBSD, Windows and macOS.
• Covers cloud, on-premise and running Docker container targets through the same scanning model.
• Correlates findings against NVD and JVN (Japanese) databases and vendor OVAL feeds from Red Hat, Debian, Ubuntu, SUSE and Oracle Linux.
• Consumes vendor security advisories including Alpine-secdb, Red Hat Security Advisories, the Debian Security Bug Tracker, the Ubuntu CVE Tracker and Microsoft CVRF.
• Reads package manager output and changelogs through commands such as yum, zypper and pkg-audit, and recognises advisory identifiers including RHSA, ALAS, ELSA and FreeBSD-SA.
• Enriches findings with exploit evidence from Exploit Database, Metasploit-Framework modules, awesome-cve-poc, PoC-in-GitHub, inthewilddb and nuclei-templates.
• Tracks CERT alerts from US-CERT and JPCERT and the CISA Known Exploited Vulnerabilities (KEV) catalog.

Who uses it and how

• System administrators who deliberately leave automatic package updates disabled in production to prevent downtime and need a scheduled manual review process instead.
• Teams running servers with large numbers of installed packages, where no person can realistically watch every package for new advisories.
• Security teams that must determine, quickly and without omissions, which servers are affected when a new vulnerability is published.
• Operators of mixed estates spanning cloud instances, on-premise hardware and running Docker containers, who want one tool rather than one workflow per environment.
• Organisations that need vulnerability reporting on a recurring cadence, driven by CRON or another scheduler, rather than an ad hoc scan.

Getting started

Installation and configuration are documented through the project repository and the vuls.io documentation site, and the README points readers to the supported operating system list and setup documentation. The README excerpt provided does not name a single package, Docker image or compose file, so the documentation is the correct starting point.

How it compares

No list of paid products that Vuls replaces is provided in the facts, and the README names no competing scanner. The systems it draws on, such as NVD, JVN, OVAL, Exploit Database, Metasploit-Framework modules and nuclei-templates, are vulnerability data sources rather than peer tools, so Vuls stands alone in this registry.

When to use it — and when not to

A self-hoster must run the scanner on a schedule, keep the vulnerability databases and advisory feeds updated, and accept the operational work that recurring reporting implies. The GPL-3.0 licence also means anyone embedding or extending the code inherits copyleft obligations. Note an honest gap: the repository description claims coverage of WordPress, programming language libraries and network devices, while the README feature list shown here documents Linux, FreeBSD, Windows, macOS, cloud, on-premise and Docker container scanning; verify the wider claims against the docs before relying on them.