Build

Custom Software DevelopmentSystems built to your process

Web Application DevelopmentReact, Next.js, Rails, Django

Mobile App DevelopmentiOS, Android, React Native

App DevelopmentWeb and mobile apps, end to end

SaaS Product DevelopmentMulti-tenant from day one

MVP DevelopmentFirst release in 6–10 weeks

Enterprise SoftwareSSO, audit trails, scale

Connect & operate

API Development & IntegrationREST, GraphQL, webhooks

Cloud & DevOps EngineeringAWS, GCP, Azure, Terraform

QA & Software TestingAutomated suites, load, E2E

Legacy ModernizationStrangler-fig migrations

Cybersecurity EngineeringHardening and remediation

Data EngineeringPipelines, warehouses, reporting

Design & teams

UI/UX DesignInterfaces people finish tasks in

Prototyping & DiscoveryScope before you spend

Staff AugmentationSenior engineers on your team

Dedicated Dev TeamsA full pod, one contract

White-Label DevelopmentEngineering under your brand

Technology ArchitectureDecide once, correctly

Project ManagementDelivery you can audit

Start hereScope a build in one callBring a spec, a wireframe, or a paragraph. You leave with an architecture, a timeline, and a number.Book a scoping call

All software development services →How we price work →Talk to an engineer →

AI software

AI Application DevelopmentFull-stack AI products

AI Agent DevelopmentMulti-step autonomous agents

AI SaaS DevelopmentMulti-tenant AI products

Workflow AutomationReplace manual ops

Custom LLM AppsBranded internal assistants

LLM & data systems

Private LLM DevelopmentSelf-hosted Llama, Mistral, Qwen

RAG DevelopmentCited answers over your docs

MCP & WebMCPMake your systems agent-callable

Vector Database Setuppgvector, Pinecone, Qdrant

Document IntelligenceOCR and extraction pipelines

Vibe coding

AI-Assisted BuildsFast, with senior review

Rapid PrototypingClickable in days

Concept to CodeIdea to working software

Code Review & CleanupMake AI output shippable

Fractional AI TeamOngoing build capacity

Ready to ship?Put AI where the work isAgents, RAG, and private LLMs wired into the systems your team already uses — not a chatbot bolted to a homepage.Discuss an AI project

AI development services →AI readiness checklist →AI vs. traditional development →

Commercial

Financial Services

eCommerce & Retail

Marketing Agencies

Real Estate

Automotive

Regulated

Healthcare & HIPAA

Legal

Government

Education

Banking

By company size

Startups & MVPs

Small Business

Enterprise

Agriculture

Domain firstWe learn your workflow before we model itRegulated, operational, or high-volume — the constraints belong in the schema, not in a training doc.Talk about your domain

Selected workSoftware we own and operateMost agencies show screenshots. We run the products — the same stack, uptime, and on-call we hand to clients.View the portfolio

The DEV.co product network

AI ERP with agents inside the systems you run

AI phone and voice agents for real calls

LLM.coPrivate, self-hosted LLM deployments

Legal AI infrastructure for firms

AI RFP discovery and response drafting

Automatic.coBusiness process automation

CyberAttack.aiThreat detection and defense

Secure AI virtual data rooms

Compare

Custom Software vs. SaaS

In-House vs. Outsourced

MVP vs. Full Product

AI vs. Traditional Development

Tools & reading

Software Cost Calculator

Project Scope Template

Engineering Blog

Open Source

Plan smarterEstimate before you commitCost ranges, scope templates, and the questions we ask in discovery — free, no form.Open the cost calculator

DEV.co

About

Careers

Locations

Contact

Real conversationsTalk with a technical leadNo SDR, no discovery gauntlet. The person on the call is the one who scopes the build.Book a call

Open-Source Security · ossf

cve-bin-tool

CVE Binary Tool is an open-source Python utility for scanning software binaries and bill-of-materials (SBOM) files against known vulnerabilities from NVD, Red Hat, OSV, and other sources. It can auto-detect components in binaries, generate SBOMs, and produce reports in multiple formats for CI/CD integration.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/ossf/cve-bin-tool

1.7k

GitHub stars

636

Forks

Python

Primary language

GPL-3.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	ossf/cve-bin-tool
Owner	ossf
Primary language	Python
License	GPL-3.0 — OSI-approved
Stars	1.7k
Forks	636
Open issues	209
Latest release	v3.4 (2024-09-17)
Last updated	2026-07-08
Source	https://github.com/ossf/cve-bin-tool

What cve-bin-tool is

The tool operates in two modes: binary scanning (448 checkers for components like OpenSSL, libpng, libxml2) and component-list scanning (SBOM/CSV/package lists). It downloads CVE data daily from multiple sources, matches discovered or provided components against vulnerability databases, and generates reports with optional triage and VEX output. Built in Python with CLI interface; supports offline operation.

Quickstart

Get the cve-bin-tool source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/ossf/cve-bin-tool.git2cd cve-bin-tool3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Supply chain vulnerability discovery in CI/CD

Integrate into build pipelines to automatically scan dependencies and binaries on each commit, providing early warning of known vulnerabilities before deployment.

SBOM-driven compliance scanning

Scan existing SBOMs (SPDX, CycloneDX, SWID) for vulnerabilities without re-analysis; useful for validating third-party software or auditing organizational inventory.

Automated component detection and vulnerability tracking

Generate SBOMs from builds and track vulnerability status over time using triage features; maintains historical context for security posture analysis.

Implementation considerations

GPL-3.0 license requires open-source release of modifications; assess internal policy before integrating into proprietary tools or workflows.
First run downloads large CVE datasets (time-dependent on network); plan initial setup and consider caching data for CI/CD performance.
Binary scanning accuracy depends on component signature availability (448 checkers); may miss obscure or heavily patched binaries.
Requires system libraries for file extraction (Linux/Windows); additional dependencies beyond pip may be needed.
NVD API reliability issues mentioned in docs; tool uses cveb.in mirror by default, but custom NVD_API_KEY support available.

When to avoid it — and what to weigh

Real-time vulnerability alerting required — Tool downloads CVE data once per day by default; not designed for immediate zero-day response or minute-level alert subscriptions.
Closed-source or proprietary component analysis — Binary checkers target common open-source components; does not provide generic binary reverse engineering or proprietary software vulnerability assessment.
GPL-3.0 license incompatible with your codebase — Tool is licensed under GPL-3.0, which requires derivative works to be open source; not suitable for closed-source applications that link or embed it.
Offline-only environments without pre-cached data — Initial run requires downloading vulnerability data from online sources; subsequent runs can operate offline, but first-time setup needs internet access.

License & commercial use

GNU General Public License v3.0 (GPL-3.0). This is a strong copyleft license: any modifications or derivative works must be released under GPL-3.0 and made available as source code. Permits commercial use and internal modification, but does not permit closed-source distribution of modified versions.

Tool itself is free and open source. Commercial use is permitted (scanning proprietary software for internal security assessment). However, if you modify the tool and distribute those modifications (including as part of a commercial product), you must release them as open source under GPL-3.0. Deployment in commercial SaaS, closed-source security products, or proprietary CI/CD platforms requires legal review. Redistribution must include source code.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Strong
Assessment confidence	High

Security considerations

Tool itself is designed for vulnerability scanning; not a cryptographic library or network service. No claims about tool hardening can be verified from provided data. OpenSSF Scorecard badge suggests security review. Relies on external CVE data sources (NVD, Red Hat, OSV, etc.); accuracy depends on upstream data freshness and correctness. No details on how tool validates or sanitizes malformed binaries or SBOM inputs provided. GPL-3.0 license allows community audit but requires source review for production use.

Alternatives to consider

Trivy (Aqua Security)

Purpose-built container and artifact scanner; integrates deeper with container registries and CI/CD pipelines; Apache-2.0 licensed (permissive). Wider adoption in DevOps environments.

OWASP Dependency-Check

Focuses on dependency scanning (Maven, npm, etc.) rather than binary analysis; large community; Apache-2.0 licensed. Lighter weight for language-specific projects.

Snyk CLI

Commercial platform with free tier; integrated vulnerability intelligence and remediation guidance; primary focus on dependencies and container images; closed-source SaaS backend.

Software development agency

Build on cve-bin-tool with DEV.co software developers

Install CVE Binary Tool via pip to start scanning your binaries and SBOMs for known vulnerabilities. Integrate into CI/CD for continuous security posture visibility.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

security-tools dep-scan cve

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Security DevOps Application Development Cloud Deployment Talk to DEV.co

cve-bin-tool FAQ

Can I use this in a commercial product if I don't modify it?

Yes. You may use the unmodified tool to scan your software for vulnerabilities internally or as part of a commercial service. If you modify the tool or bundle it with proprietary code, license review is required.

How does binary scanning work? Will it find vulnerabilities in my custom binaries?

It uses 448 checkers that look for signatures of known open-source components (OpenSSL, libpng, libxml2, etc.). It does not reverse-engineer or analyze custom code; it matches binary signatures against a known-component database.

Does it require internet access?

First run downloads CVE data; subsequent scans can run offline. By default, data refreshes once per day. Pre-download data for air-gapped environments.

What SBOM formats are supported?

Input: SPDX, CycloneDX, SWID. Output (generation): SPDX and CycloneDX. Does not include license information in generated SBOMs.

Senior engineers for your next build

Teams bring us cve-bin-tool after the evaluation, when it needs to work in production. DEV.co delivers custom software development services — integration, hardening, monitoring, and maintenance for open-source security systems.

Secure Your Supply Chain with Automated Vulnerability Scanning

Install CVE Binary Tool via pip to start scanning your binaries and SBOMs for known vulnerabilities. Integrate into CI/CD for continuous security posture visibility.

Talk to DEV.co Schedule a Consultation