CVE Binary Tool review
A free, self-hosted scanner for binaries, dependencies, SBOMs, and CI workflows.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
CVE Binary Tool is an open-source command-line security tool for developers and security teams. It scans binaries, directories, archives, language-specific dependency files, and SBOMs for known vulnerabilities. It also generates SPDX and CycloneDX SBOM files, creates VEX documents, supports vulnerability triage data, and produces console, CSV, JSON, JSON2, HTML, and PDF reports. Its free, self-hosted model suits teams that want local or offline scanning without a commercial platform tier.
The tool covers a broad set of input types and software ecosystems, including Dart, Go, Java, JavaScript, Perl, Python, Rust, Ruby, R, Swift, OpenWrt packages, and Windows PE files. SBOM workflows support SPDX, CycloneDX, and SWID inputs, while generated SBOMs use SPDX or CycloneDX. GitHub Actions provides an official path for CI scanning and pull request workflows. Outside that integration, the deployment model remains self-hosted, so teams are responsible for fitting the tool into their own development and security processes.
CVE Binary Tool is a strong choice when the priority is free vulnerability scanning across binaries, dependency files, and SBOMs, especially for teams that value local operation, report formats, VEX support, and reusable triage data. Its scope is narrower than a full SCA platform: documented capabilities do not include verified reachability analysis, and the integration surface is limited. Organizations seeking broader platform integrations or reachability-focused prioritization should choose another SCA product instead. Teams comfortable with command-line and self-hosted tooling will find its focused coverage more suitable.
CVE Binary Tool pros and cons
- Where it wins
- Scans binaries, archives, directories, dependencies, and SBOMs
- Generates SPDX and CycloneDX SBOMs plus VEX documents
- Supports detailed reports and official GitHub Actions integration
- Where it doesn't
- Self-hosted deployment requires local setup and maintenance
- Integration coverage is limited to GitHub Actions
- Does not provide verified reachability analysis
CVE Binary Tool fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update