# CVE Scanning

Escape automatically scans every detected technology for **known CVEs** (Common Vulnerabilities and Exposures). Once [technologies are identified](<https://docs.escape.tech/documentation/asm/asset-types-and-classification/index.md>) on your assets, they are matched against a vulnerability database to surface dependencies with known security issues.

> **Why it matters:** vulnerable dependencies are one of the most common attack vectors. Escape turns your technology inventory into a continuously updated vulnerability assessment without any manual effort.

## How It Works

1. **Technology Detection**: Escape identifies technologies running on your assets through [fingerprinting and dependency analysis](<https://docs.escape.tech/documentation/asm/asset-types-and-classification/index.md>).
2. **Vulnerability Matching**: Each detected technology is matched against known advisories in a vulnerability database.
3. **Finding Generation**: When a match is found, a finding is created with full context: CVE ID, Escape severity, advisory CVSS score and vector (when available), description, affected versions, fix version (when available), and reference links.

## Versioned and Versionless Matching

The accuracy of CVE matching depends on whether a specific version was detected:

| Detection | Matching approach | Confidence |
| --- | --- | --- |
| **Versioned** (for example `express@4.17.1`) | Precise matching against known affected version ranges | High: only CVEs that affect the exact version are reported |
| **Versionless** (for example `nginx`, no version) | A selection of potential CVEs associated with the technology | Lower: potential CVEs are grouped into one issue per technology with reduced severity because the affected version hasn't been confirmed |

For versionless findings, verify the version in use against the advisory's affected versions before treating the finding as confirmed.

## What Gets Reported

Each CVE finding includes:

- **CVE ID**: The unique identifier (for example `CVE-2024-12345`)
- **Severity**: Escape's issue severity can differ from the advisory's CVSS rating. Findings with an unknown version have reduced severity to reflect uncertainty
- **Description**: What the vulnerability is and how it can be exploited
- **Affected Versions**: The version range impacted by the CVE
- **Fix Version**: The version that resolves the vulnerability (when available)
- **References**: Links to advisories and technical details

Findings appear as **Dependency with Known CVE** when a version is confirmed, or **Dependency May Be Affected by Known CVE** when the version is unknown. Findings are linked to the affected technology.

## Coverage

CVE matching covers detected technologies such as:

- Web servers, application frameworks, and programming languages
- JavaScript libraries, Python packages, and dependencies from all major package ecosystems
- Databases, CMS platforms, reverse proxies, and infrastructure software
- Frontend JavaScript libraries embedded in web applications

## Vulnerability Reference

For detailed information on specific vulnerability tests, see the [Security Tests Reference](</documentation/reference/vulnerabilities/>). CVE-related tests include:

- [Vulnerable Dependency](</documentation/reference/vulnerabilities/potential_cve/>): Technologies with known CVEs detected through dependency and fingerprint analysis
- [Vulnerable JavaScript Library](</documentation/reference/vulnerabilities/frontend_potential_cve/>): Frontend JavaScript libraries with known CVEs detected through client-side code analysis

## Related Documentation

- [Technology Detection](<https://docs.escape.tech/documentation/asm/asset-types-and-classification/index.md>)
- [Asset Management](<https://docs.escape.tech/documentation/asm/asset-management/index.md>)
- [Security Tests Reference](</documentation/reference/vulnerabilities/>)