Stop chasing the same CVE across every host.
oxharden turns distro advisories, exploit signals, package matches, and host observations into one fleet-wide CVE record, so you see whether it is exploited, where it exists, and what fixes it by distro.
A CVE row is not an answer.
oxharden shows whether it is being exploited, which hosts are still affected, and what fixes it for each distro, all in one fleet-wide record.
Exploitation beats severity.
Each CVE record combines KEV, EPSS, and CVSS so confirmed and likely-exploited vulnerabilities rise above raw severity. KEV due dates are surfaced where available, so overdue exploited CVEs stay impossible to miss.
See every host a CVE still affects.
Each CVE record rolls up affected, fixed, and unresolved hosts, including systems that read as patched but still need a reboot or service restart. Break blast radius down by OS, workspace, and system so teams know exactly where the risk remains.
CPE guessing stops here.
One upstream CVE can mean different package names, fixed versions, and advisories across RHEL, Rocky, AlmaLinux, Oracle Linux, and Amazon Linux. oxharden maps each affected package to the distro advisory and fixed-in NEVRA where available, so teams fix the right package on the right hosts.
No black-box CVE scoring.
Each CVE record shows the sources, advisories, exploit signals, and fleet observations behind the score, so teams can explain why a vulnerability was prioritized and what changed over time.
From scattered advisories to one record.
Correlate
Installed NEVRA on each host is matched against distro security advisories and NVD records, then deduplicated into a single fleet-wide CVE.
Enrich
Each CVE record is layered with exploit intelligence and provenance: KEV status, EPSS percentile, CVSS, CWE, references, and every advisory that addresses it.
Resolve
For each affected host, oxharden resolves current status: affected, fixed, pending restart, pending reboot, or exceptioned, with fixed-in version data where available.
The technical details, up front.
No black box. Here's exactly where each CVE record comes from, how it's matched, and how status is resolved per host.
Do not stop at the CVE ID.
oxharden connects each CVE to the package that fixes it, the hosts still affected, and the other risk views that explain priority.
Launch your first scan in minutes.
Not ready to install? Click around the live demo with real fleet data first. Then start a 14-day free trial on up to 30 of your own hosts.
curl -fsSL https://packages.executepath.dev/install.sh \ | sudo EXPECTED_GPG_FINGERPRINT=13094D5AB037E6CD79CDFA3A51687EAC6B931A09 bash
✓ inventory synced · 410 packages · 4 ports
✓ first scan complete · 12 critical · 19 vulnerable pkgs
CVE records, answered.
A scanner often creates one finding per vulnerable package per host. oxharden deduplicates those into one fleet-wide record per CVE: affected hosts, impacted packages, distro-specific fix data, and exploit signals in one place. You triage the vulnerability once, then act on the hosts and packages it touches.
CVSS comes from NVD and vendor records where available, KEV from CISA's Known Exploited Vulnerabilities catalog, and EPSS from FIRST. oxharden keeps the sources visible on the record and prioritizes confirmed exploitation, exploitation likelihood, and severity together.
Because the fix may be installed but not live: a kernel update awaiting reboot, or a shared library updated on disk while long-running services still map the old copy. oxharden keeps the CVE open for that host until the fixed code is actually in effect.
Per-distro vendor advisories such as RHSA, ELSA, ALAS, and Rocky / Alma errata, mapped to fixed-in NEVRA where available.
JSON is available today. CSV, SARIF, and API workflows are planned for reporting and integrations.
CPEs are useful, but Linux vendors often backport fixes without changing upstream version numbers. oxharden uses distro advisories and fixed-in package versions where available so remediation follows the vendor's security data, not CPE guesswork.
Yes. The same upstream CVE can map to different package names, advisories, and fixed-in versions across RHEL, Rocky, AlmaLinux, Oracle Linux, and Amazon Linux. oxharden keeps those distro-specific fixes attached to the same CVE record.
It means the package fix is present, but vulnerable code may still be running. Reboot applies a fixed kernel; service restart clears processes still mapped to replaced shared libraries.