Vulnerabilities and exposure
Software inventory and vendors
What your scans proved the site runs, split into versioned software that can be checked and software only seen; confidence, detector and last-seen; and vendors.
Updated · 2 min read
Every scan observes software: a CMS from its meta tags, a framework from its markup, a server from its headers, a library from a script path, a version from any of those. The inventory is what all of that adds up to, and it is what the KEV and CVE feeds are matched against.
Where
- Web: Security, Software; Security, Vendors for the rollup.
- iOS: a domain's Vulnerabilities module, Software segment. The vendor rollup lives under Account, Service status.
- API/MCP:
GET /api/vuln-scan/components(portfolio),GET /api/vuln-scan/vendors,/vendors/:vendor; toolsget_observed_components,list_software_vendors,get_software_vendor.
Checkable versus seen
Software that exposed a version leads, because a version is what lets it be compared to a published advisory. Everything else (a CDN, an analytics tag, a font service, a framework with no version) is grouped by what it is, collapsed, and never counted as checked: an unknown version is unknown, not clear.
Each reading
| Field | Meaning |
|---|---|
| Confidence | High, medium or low, from how the detector saw it (a generator tag is high; a filename pattern is low) |
| Detector | Which check read it: the technology fingerprint, a Nuclei template, Trivy, the header parser |
| Host | Which host it was on |
| Last seen | The newest scan that observed it |
Reconciliation
The inventory is reconciled on every scan rather than appended to: a component that a scan of the same host no longer sees is retired from the current inventory (it stays in history), so a site that moved off WordPress stops carrying WordPress advisories. The scanner's own egress is discounted, so a fetch that passed through Cloudflare does not put Cloudflare on every site.
Name matching
Advisories are matched to products by canonical name, not by token overlap. "WP Engine" no longer matches Exchange CVEs on the word "Exchange". Where a component has no version, a matching advisory is labelled a name match and shown under Watching, never as a finding.
Vendors
The same evidence rolled up by company: every vendor the portfolio runs on, with component counts and open advisories, and how much of the portfolio the list rests on. A vendor with a status page shows its live status; one without shows "CVEs and KEVs only" and opens its advisory history.
Common questions
The inventory says my site runs software it does not. Open the reading: the detector and the evidence say what was seen. A theme that ships another CMS's assets is the usual cause. Dismiss the reading as a false positive and it stays dismissed across re-scans.
Why does the inventory look short? Most often because domains have never been cleared, so only the passive fingerprint runs. The Software view names those domains.
Keep reading
Related articles
- The software watchlistTrack a product so the next KEV or CVE against it alerts you: alert cadence, sources, severity filter, and the split between site software and device software.Vulnerabilities and exposure ·Updated
- Findings, carry-forward and dismissalsWhat a finding shows, why a finding from a heavier scan survives a lighter one, and the four reasons a finding, a software reading or an alert can be silenced.Vulnerabilities and exposure ·Updated
- Groups, Personal and BusinessTwo ways to organise a portfolio: free-form group labels, and the Personal/Business split that files a domain under a client.Domains ·Updated