Vexta's Offline CVE Scanner: 10,000+ Templates, No Network Needed

An offline CVE scanner is a tool that can detect and match known vulnerabilities against a target without a live connection to NVD or any other public feed at scan time. Vexta is built this way from the ground up: it bundles over 10,000 detection templates and a local mirror of NVD, EPSS, and CISA KEV data directly in the binary, so a scan's CVE matching depends on nothing but the machine it runs on.

The problem: scanners that need to phone home mid-scan

A lot of scanning tools query an external CVE database or a vendor's cloud service in the middle of a scan to check a detected version against known vulnerabilities. That works fine on an open network, but it fails or slows down in the environments where a lot of serious testing happens: air-gapped internal networks, client environments with tight egress rules, or segments deliberately isolated from the internet during an engagement.

Even outside air-gapped work, depending on a live feed means a scan's CVE coverage is only as reliable as that feed's uptime and rate limits at the moment you happen to be running. A hunter should not have a scan slow down or drop coverage because a public API had a bad afternoon.

How does Vexta's local CVE mirror work?

Vexta's CVE database pulls from three feed sources: the NVD itself for CVE records, CPE match tables, and CVSS scores; EPSS from FIRST.org, updated daily, which is the Exploit Prediction Scoring System, a probability estimate of a vulnerability being exploited in the wild; and the CISA Known Exploited Vulnerabilities catalog, also updated daily, which lists CVEs with confirmed real-world exploitation.

All of it lives in local SQLite storage, so lookups do not depend on NVD being reachable at scan time. A `MatchCPE` function returns CVEs matching a given vendor, product, and version with proper version-range comparison, and a direct `LookupByID` call resolves a specific CVE by its identifier. Vexta also tracks feed state internally, including the last sync time, record counts, and status per feed, so a hunter can see how current the local mirror actually is.

What does 10,000+ bundled templates actually mean?

Separately from the CVE database, Vexta ships a Nuclei-compatible YAML template engine with severity filters and tag-based inclusion or exclusion. Over 10,000 templates are embedded directly into every binary at build time, not downloaded on first run.

That bundle breaks down across categories: roughly 3,984 CVE-tagged HTTP detectors, 942 generic web vulnerability checks that are not CVE-specific, 952 misconfiguration checks, 1,377 exposed admin and management panel detectors, 690 sensitive file and endpoint exposure checks, 884 technology fingerprints, 295 vendor default-credential checks, 247 credential and API-key validity tests, 281 non-HTTP network service probes, and smaller sets covering IoT devices, subdomain takeovers, and DNS/SSL/miscellaneous checks, plus a curated top-level set of KEV-flagged CVEs. The total lands around 10,128 templates, all present the moment the binary starts, before any network call happens.

Does Vexta ever need the internet?

By default, no, not to run a scan. The template updater runs a bootstrap check at server startup: if the on-disk template cache is empty, it syncs immediately rather than waiting on the normal update schedule, so a fresh install is not stuck with a stale cache for the first two weeks. After that, updates follow a 15-day refresh cycle, pulling first from Vexta's own curated, signed manifest, and only falling back to the broader open-source Nuclei community template set if that curated source is empty or unreachable. That fallback is on by default but can be switched off entirely with an environment variable for genuinely air-gapped deployments.

Combine the bundled templates with the local NVD mirror, which covers roughly 250,000 CVE records for tech-fingerprint-to-CVE matching without any network call, and day-zero offline coverage exceeds 16,000 CVE detections before a single external request is made.

Why this matters for the kind of work bug hunters actually do

For an internal engagement on a segmented network, or a client environment where egress is locked down for the duration of a test, a scanner that needs to reach the internet to know what CVE it just found is a scanner that cannot do its job in scope. Vexta's design removes that dependency at the layer that matters most, template execution and CVE lookup, while still offering an update path for hunters who do have connectivity and want the latest coverage.

It also means consistency: the same binary run on two different networks, one connected and one air-gapped, detects the same 10,000-plus templates and matches against the same local CVE data either way. Template synchronization and update behavior may vary slightly by license; see plans on the pricing page for specifics.

Key takeaways

What the offline CVE database and bundled templates mean in practice: