CVEngine

CVEngine is an open-source external attack surface assessment tool that discovers assets, matches vulnerabilities, and runs validation checks.

CVEngine automatically discovers and maps internet-facing assets, fingerprints services and versions, and identifies live vulnerabilities. It combines asset discovery, vulnerability scanners, and threat feeds into a single continuous workflow to deliver verified security verdicts. The tool features automated asset discovery, nmap and nuclei integration, AI-assisted finding triage, and safe read-only validation checks. It is designed for security teams and bug bounty hunters who manage attack surfaces and need actionable data. Users can bring their own AI models from Anthropic, OpenAI, OpenRouter, Ollama, or vLLM.

CVEngine at a glance

Best for: Software engineer
Runs on: Web, Linux, API, self-hosted, open source
Pricing: Free
Released: October 2026
Category: AI coding tool
Website: github.com/hevnsnt/cvengine

Key features

Discover domains, subdomains, IPs, and ports
Fingerprint services, versions, and TLS
Triage findings with artificial intelligence
Run safe read-only validation checks
Monitor changes on a visual timeline
Search hosts, ports, and findings
Integrate via REST API and MCP server

Use it for

Discovering and mapping internet-facing assets
Validating live vulnerabilities with read-only checks
Triaging security findings using artificial intelligence
Conducting bug bounty hunting and target scoping

Alternatives to CVEngine

AutoCVE — Automates the entire CVE discovery workflow from source code audit to report generation.
Cve Intel — Query 40 sources for real-time vulnerability intelligence and risk scores.
Robusta — Reduces costs and noise by investigating unique incidents instead of raw alerts.
PentAGI — It autonomously manages penetration testing workflows within a secure Docker sandbox.
VulnClaw — It uses LLM agents to autonomously execute end-to-end security testing loops.
Pixee — Automates vulnerability triage and generates actionable code fixes.
Pentest AI — Eliminates false positives by reproducing every exploit three times.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
OpenAPPA — Tracks data flows algebraically to prevent prompt injection without breaking agents.
HackerOne — Combines AI agents with expert human researchers to prioritize and fix real risks.
Open Kritt — Orchestrates parallel AI agents to find and verify high-impact code vulnerabilities.
AiSOC — Runs locally without API keys with bundled models and auditable reasoning ledgers.

All CVEngine alternatives