CVE Binary Tool
CVE Binary Tool: A free, self-hosted scanner for binaries, dependencies, SBOMs, and CI workflows. Ranked #43 of 65 in Software Composition Analysis Software by our editors (5.3/10); pricing: Free plan; best for free binary and SBOM vulnerability scanning.
At a glance
- Editor score5.3 / 10
- PricingFree plan
- Best forFree binary and SBOM vulnerability scanning
- Free planYes
- Paid fromFree
- SBOM generationYes
- Facts checked19 Sep 2026
Where it wins
- Scans binaries, archives, directories, dependencies, and SBOMs
- Generates SPDX and CycloneDX SBOMs plus VEX documents
- Supports detailed reports and official GitHub Actions integration
Where it doesn't
- Self-hosted deployment requires local setup and maintenance
- Integration coverage is limited to GitHub Actions
- Does not provide verified reachability analysis
Our verdict on CVE Binary Tool
CVE Binary Tool is an open-source command-line security tool for developers and security teams. It scans binaries, directories, archives, language-specific dependency files, and SBOMs for known vulnerabilities. It also generates SPDX and CycloneDX SBOM files, creates VEX documents, supports vulnerability triage data, and produces console, CSV, JSON, JSON2, HTML, and PDF reports. Its free, self-hosted model suits teams that want local or offline scanning without a commercial platform tier.
The tool covers a broad set of input types and software ecosystems, including Dart, Go, Java, JavaScript, Perl, Python, Rust, Ruby, R, Swift, OpenWrt packages, and Windows PE files. SBOM workflows support SPDX, CycloneDX, and SWID inputs, while generated SBOMs use SPDX or CycloneDX. GitHub Actions provides an official path for CI scanning and pull request workflows. Outside that integration, the deployment model remains self-hosted, so teams are responsible for fitting the tool into their own development and security processes.
CVE Binary Tool is a strong choice when the priority is free vulnerability scanning across binaries, dependency files, and SBOMs, especially for teams that value local operation, report formats, VEX support, and reusable triage data. Its scope is narrower than a full SCA platform: documented capabilities do not include verified reachability analysis, and the integration surface is limited. Organizations seeking broader platform integrations or reachability-focused prioritization should choose another SCA product instead. Teams comfortable with command-line and self-hosted tooling will find its focused coverage more suitable.
Your product? Our editors can test CVE Binary Tool in depth and publish a review, labelled as paid · from $149/mo →
CVE Binary Tool pricing
CVE Binary Tool fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Supported ecosystems | Dart (pubspec.lock); Go (go.mod); Java (pom.xml, JAR/WAR/EAR); JavaScript (package-lock.json, yarn.lock); OpenWrt opkg (.control); Perl (cpanfile); Python (requirements.txt, PKG-INFO, METADATA, .whl, .egg); Rust (Cargo.lock); Ruby (Gemfile.lock); R (renv.lock); Swift (Package.resolved); Windows PE (.pyd) |
| SBOM generation | Yes |
| Reachability analysis | Not verified |
| Pull request scanning | Yes |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Desktop |
| Platforms | Linux, Windows |
| Integrations | 1 integrations: GitHub Actions |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 19 Sep 2026 |
CVE Binary Tool integrations
CVE Binary Tool lists 1 integrations on its own site.
- GitHub Actions
Alternatives to CVE Binary Tool
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all CVE Binary Tool alternatives →
Used CVE Binary Tool? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used CVE Binary Tool for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
CVE Binary Tool is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/cve-binary-tool/"><img src="https://www.itechguides.com/best/badge/cve-binary-tool.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update