VigieVuln is a polyglot dependency auditor built for professional code audits.

It scans dependencies and 9 CMS/frameworks in one pass without build tools, supports air-gapped workflows, detects private packages, binaries and certificates, and produces HTML, JSON and other reports.

🌐 Project site & docs →

Terminal demo recorded with VigieVuln 1.2.1.

Features

• Multiple ecosystems in one pass: Maven and Gradle, npm/Yarn/pnpm, Composer, PyPI, NuGet, Go and Ruby — plus vendored JS, committed native binaries and embedded JARs.
• No build tools; No mvn/gradle/npm/pip/dotnet/go, no node_modules/ → how
• CVE from multiple sources, merged & prioritised; CVEProject + OSV.dev + Packagist security advisories + NVD, ranked CISA KEV → EPSS → CVSS.
• European vulnerability references: ENISA EUVD id + ENISA's exploited flag, GCVE id, and the CERT-FR advisories citing it. Hosted proxy lookups send relevant CVE identifiers to the proxy.
• Beyond CVEs; Report EOL and out-of-active-support frameworks, deprecated/abandoned/yanked, outdated, SPDX licenses, and private/internal packages
• CMS & frameworks audited as instances; Symfony, Laravel, WordPress, Drupal, Joomla, PrestaShop, TYPO3, Magento/Adobe Commerce and SPIP with per-instance inventory (core, plugins, themes, bundles, components) → the dedicated guide
• Crypto material; committed certificates, private vs public keys across PEM/OpenSSH/PuTTY/PGP and JKS/PKCS#12 keystores.
• Air-gapped flow; zero network under --offline → Benchmark · Air-gapped
• Hosted proxy with a verified account; --set-proxy-cache vigievuln → hosted proxy
• Project monitoring; vigievuln watch ./project --name 'My Project' — one free project with up to 100 distinct direct dependency coordinates → monitoring guide
• Shared cache for a scanner fleet; vigievuln serve-cache + --proxy-cache → cache usage
• Supply-chain risk; known-malicious advisories and suspected typosquats (--typosquat).
• Audit-grade; every report carries a provenance manifest and a Methodology & limitations chapter; a SHA256SUMS;
• Differential audits diff against a prior run (--baseline) and CI can gate on new findings only.
• Reports in English or French (--lang fr)
• Outputs & CI; Pro HTML report + JSON baseline by default + Word, Excel, CycloneDX 1.6 SBOM, CSAF 2.0 VEX, SARIF 2.1.0, JSON; gate with --fail-on, triage with --ignore/--vex.
• Report made for productivity; every table / chart has a Copy for word button.

📖 Usage & all flags · Architecture · Comparison vs other tools · Data sources

Quick start

npm install -g vigievuln
vigievuln scan ./code             # → ./vigievuln-report/cve-report.html

A free NVD API key (instant) gives 10× faster enrichment: vigievuln --set-nvd-key YOUR_KEY. A few common runs; full list via vigievuln --help or docs/USAGE.md

Monitor a project

Monitor your project's direct dependencies for new high, critical or known exploited vulnerabilities. Create and verify a Vigie Vuln account first.

vigievuln login                                  # sign in and accept the terms
vigievuln watch ./project --export deps.json     # optional: review the inventory locally
vigievuln watch ./project --name 'My Project'     # upload or update the project
vigievuln project status                         # check the monitoring status

Review the inventory before sharing, enable alerts in your account and upload again when dependencies change. The free tier covers one project, 100 direct coordinates and a 0.5 MB descriptor; each upload renews monitoring for one month. Monitoring guide.

Official Vigie Vuln proxy cache

Use Vigie Vuln DB as a European-hosted source for scans, including reviewed VigieVuln advisories for Maven and npm.

vigievuln login                 # sign in and select the official proxy if none is configured
vigievuln scan ./code           # scan using the saved proxy and key
vigievuln setup --mode direct --sources all  # switch back to direct sources

The proxy receives package coordinates and CVE identifiers, not source code. Cached advisories remain usable offline; partial version evidence leaves other versions unknown. Proxy guide.

Interactive HTML samples

• Apache Dubbo 2.7.8 — open the report: the project used for the report screenshot below, rescanned with VigieVuln 1.2.1; 105 Maven descriptors, direct/transitive CVEs, KEV matches, EOL and fix recommendations.
• Multi-instance CMS & frameworks — open the report: WordPress 6.4.2, Drupal 8.5.0, Symfony Demo (Symfony 7.1.1) and BookStack v24.10 (Laravel 10.48.22), with findings attributed to each instance.

These are standalone reports from real source scans, generated on 2026-11-04 with VigieVuln 1.2.1. Dubbo uses the hosted proxy; the CMS sample uses its local cache offline and focuses on PHP dependencies. Missing Wordfence/Drupal advisory and WordPress checksum inputs are explicitly marked incomplete. Sample scope, sources and reproduction commands.