CVE Detection

Targeted scanning for specific CVEs. When an advisory drops (Log4Shell-class news), run a fleet-wide 'are we vulnerable?' check in minutes.

When you'd use it

Standard SCA scans your dep manifests and reports every known vulnerability. CVE Detection is the opposite: you supply one or more specific CVEs, and Sectora reports which of your assets are vulnerable. Three common scenarios:

  • Advisory just dropped. CVE-2024-XYZW is announced; you need to know which of your services are exposed before attackers test.
  • Auditor request. "Please confirm no exposure to these 12 CVEs in the past quarter." CVE Detection generates the report in 5 minutes.
  • Vendor security advisory. Your IaaS provider issues a CVE alert; you scope a scan to just those CVEs across all impacted assets.

How a CVE Detection scan works

Pulls four detection methods, in order of speed + confidence:

  1. SCA cross-reference — checks if any of your dep manifests reference an affected version. Fastest; 100% confidence on a match.
  2. Nuclei template match — for CVEs with published exploit signatures, runs the template across your DAST targets. Catches running instances even when SCA missed the manifest.
  3. Tech fingerprint — your DAST tech-fingerprint inventory checked against the CVE's affected products. Lower confidence; surfaces "possibly affected" for manual review.
  4. Custom Sectora patterns — for CVEs without public templates yet, Sectora's security team writes detection rules within 48h of disclosure. Available before public Nuclei templates exist.

Running a CVE scan

# Via UI: Scans → New CVE scan → paste CVE list

# Via API:
POST /api/v1/cve-scans
{
  "cves": ["CVE-2024-3094", "CVE-2024-21413", "CVE-2024-4577"],
  "targets": "all",         # or specific asset IDs
  "methods": ["sca", "nuclei", "tech_fingerprint"]
}

Saved CVE lists

Common patterns:

  • CISA KEV — the latest KEV catalog as a list. Auto-updates as KEV grows.
  • Vendor-specific — "all CVEs published by Apache in 2024", "all Spring Framework CVEs".
  • Compliance-driven — "all CVEs my auditor flagged in last quarter".
  • Hot-vendor — "CVEs affecting Cloudflare / AWS / GCP this month".

Create at Settings → CVE Lists. Schedule the list as a recurring scan to track exposure over time.

Confidence levels

Each finding includes a confidence score:

  • Confirmed (1.0) — Nuclei exploit fired successfully on a live target.
  • High (0.7-0.9) — SCA manifest matches an affected version.
  • Medium (0.4-0.6) — Tech fingerprint suggests affected product but version uncertain.
  • Low (0.1-0.3) — Heuristic match; needs manual review.

Fleet-wide reporting

After a CVE scan completes, generate an "Exposure Report" — per-CVE breakdown of which assets are affected (or confirmed safe). Suitable for executive + auditor consumption. Includes:

  • Total assets scanned
  • Per-CVE: affected count, confirmed-safe count, manual-review count
  • Recommended next actions (rotate keys, upgrade dep, deploy virtual patch)
  • Timeline + audit trail of detection events

What's next

  • SCA — the broader continuous version of CVE Detection.
  • Threat Intelligence — KEV integration + technique mapping.