Local-first Linux security review

See what your Linux desktop is actually exposed to.

CVEChecker inventories the operating system, installed software, optional project lockfiles, and core hardening posture, then correlates that data against vendor advisories, OSV, and the NVD.

View on GitHub Run Locally

Local-first scan flow
Debian, Ubuntu, and RHEL vendor feeds
OSV and NVD correlation
Coverage gaps and confidence levels

Live App View Dark Mode

CVEChecker main window showing application inventory, findings, filters, and detailed CVE context

Inventory breadth

From OS packages to project lockfiles

CVEChecker reads Linux package inventory from dpkg, rpm, flatpak, snap, pip, npm, cargo, gem, and local Go binaries, with opt-in lockfile discovery for active projects.

Evidence sources

Vendor-aware, not just generic CVE search

Debian Security Tracker, Ubuntu CVE data, Red Hat Security Data, OSV, and the NVD are combined so system packages and app ecosystems get the strongest match source available.

Decision support

Confidence and coverage stay visible

Findings are labeled as confirmed, probable, or needs review, while warnings and coverage gaps stay visible instead of being hidden behind false certainty.

How it works

Built for fast local review, not remote inventory upload.

Inventory the machine

Collect installed OS, package, application, kernel, and optional project dependency data on the host you run it on.

Correlate against multiple sources

Match supported packages against vendor advisories first, then use OSV and NVD where exact or useful mappings exist.

Review exposure and posture

Work through CVEs, hardening checks, network exposure signals, and explicit coverage gaps from one desktop view.

Features

Practical visibility for Linux desktops and workstations.

Local application and OS inventory

Scans the machine you run it on, including the operating system, installed packages, and mapped desktop apps.

Optional project dependency discovery

Supports opt-in discovery of Python, Node.js, and Rust lockfiles in the home directory without executing package-manager commands.

Vendor advisory matching

Uses distro-specific advisory sources for Debian, Ubuntu, and RHEL where direct package correlation is available.

Exact mapped app checks

Supports mapped Flatpak and Snap application CPE lookups for common desktop apps such as Firefox, Chromium, Thunderbird, Slack, and Zoom.

Hardening and exposure context

Surfaces posture checks for firewall state, automatic updates, SSH policy, Secure Boot, disk encryption signals, audit logging, and listening services.

Warnings that stay honest

Shows data-source problems and unmapped coverage directly in the UI so ambiguous or partial results are obvious to the operator.

Result handling

Confidence that does not pretend certainty.

Public vulnerability data is messy. CVEChecker makes that explicit by separating confirmed matches from probable and needs-review findings, then pairing them with the matching source and recommended next step.

Confirmed: Strong version or source evidence ties the finding to installed software.
Probable: A useful match exists, but the available metadata is not strong enough to claim certainty.
Needs review: Source data is incomplete or ambiguous enough that manual validation is still required.

Coverage boundaries

Missing mappings remain visible in the workflow.

The app reports unsupported package ecosystems, unmapped applications, source failures, and coverage gaps through the Warnings view instead of silently dropping them.

Exact app mapping gaps stay countable.
Project scanning is opt-in and explicit.
Linux desktop scope and source limitations are visible.

Screenshots

The real desktop workflow.

Main CVEChecker results view with applications, affected packages, and CVE details — **Main results view** Package inventory, affected-only filtering, findings, and detail panes in one screen.

CVEChecker settings dialog showing API key, cache, timeout, source toggles, project scan options, and dark mode — **Settings** Source toggles, project-scan controls, file locations, and dark mode.

CVEChecker hardening pane showing posture checks and selected details — **Hardening posture** Security posture checks sit alongside vulnerability review instead of in a separate tool.

Install

Run it locally in a few commands.

The desktop UI is built with PySide6. Scanning happens on the machine where you launch the app.

Set up an environment

uv --cache-dir /tmp/cvechecker-uv-cache venv .venv
uv --cache-dir /tmp/cvechecker-uv-cache pip install -p .venv/bin/python -e .[dev]

Launch the app

.venv/bin/cvechecker

# or
.venv/bin/python -m cvechecker

FAQ

What to expect from v1.

Does it upload my package inventory?

No web dashboard is required. The app runs locally and presents results in the desktop UI.

Which Linux systems are in scope?

V1 targets Linux desktop machines, with direct vendor advisory support for Debian, Ubuntu, and RHEL package data.

Does it replace vendor guidance or CIS tooling?

No. It focuses on local software exposure and selected hardening checks rather than full benchmark compliance.

Will every app map cleanly to a CVE source?

No. Some ecosystems or app identifiers do not map cleanly yet, and the app surfaces that as a coverage gap.