Checkmk CVE Scanner v4.0
Motivation:
Automated synchronization of SW inventory data with the NVD via API - Checkmk
Today, I would like to introduce my CVE Scanner for Checkmk.
CMK-exchange/cmk_cve_scanner at main · bh2005/CMK-exchange
The tool runs directly on the Checkmk server and reads inventory data directly from the local filesystem. This means zero HTTP overhead, no need for an API user, and native multi-site support. It correlates your inventory against several major CVE databases:
Data Sources Comparison
| Source | Batch Support? | Rate Limit | Strengths |
|---|---|---|---|
| OSV.dev |  100 per batch |
None | Native Debian/Ubuntu support, GHSA, very comprehensive |
| OSS Index | 128 per batch |
~64/h (anon), more w/ account | PURL-based, excellent library coverage |
| CISA KEV | JSON Feed |
None | Flags actively exploited vulnerabilities |
| NVD |  Single query |
6s / 0.7s with Key | Targeted lookups via mapping (~10% of packages) |
Recommendation: OSV + OSS Index + CISA KEV are sufficient for most environments.
NVD is optional and is only queried for packages with a pre-defined mapping to reduce API load.
Includes: Local caching and automated reports (JSON/CSV).
- Zero-API Footprint: Accesses site data via
/omd/sites/.../var/check_mk/inventory/. - Intelligent Caching: Minimizes API calls by storing scan results locally.
- Smart Mapping: Translates OS package names to NVD-compliant product names to reduce false negatives.
Architecture
/omd/sites/<site>/var/check_mk/inventory/
├── server01 ← Python-Literal-Format (ast.literal_eval)
├── server01.gz ← Compressed variant (automatically detected)
└── ...
│
▼
CheckmkInventoryReader ← Generator-based
│
├─ OsvClient → OSV.dev querybatch (100er Batches, no Key)
├─ OssIndexClient → Sonatype OSS Index (128er Batches, free)
├─ NvdClient → NVD API 2.0 (only Mapping-packages, ~10%)
└─ CisaKevClient → CISA KEV Feed (noKey, cached)
│
▼
ApiCache ← JSON-Cache (24h TTL, 2nd run: minutes instead of hours)
│
▼
CveMerger ← OSV + OSS + NVD deduplication, highest score wins
│
▼
ReportGenerator → JSON + CSV + Summary
sample CLI output
2026-02-25 14:16:06 [INFO] ============================================================
2026-02-25 14:16:06 [INFO] Checkmk CVE Scanner v3.0 — Local Mode
2026-02-25 14:16:06 [INFO] OMD Root: /omd/sites
2026-02-25 14:16:06 [INFO] Sites: test
2026-02-25 14:16:06 [INFO] Hosts: alle
2026-02-25 14:16:06 [INFO] Quellen: OSV.dev
2026-02-25 14:16:06 [INFO] Min CVSS: 4.0
2026-02-25 14:16:06 [INFO] Output: /var/log/cve_scanner
2026-02-25 14:16:06 [INFO] ============================================================
2026-02-25 14:16:06 [INFO] [test] Lese Inventory für 25 Hosts...
2026-02-25 14:16:07 [INFO] [test] → 3213 Software-Einträge
2026-02-25 14:16:07 [INFO] Gesamt Software-Einträge: 3213
2026-02-25 14:16:07 [INFO] Unique Software/Version: 1693
2026-02-25 14:16:07 [INFO] ───────────────────────────────────────────────────────
2026-02-25 14:16:07 [INFO] OSV.dev Batch-Lookup...
2026-02-25 14:16:07 [INFO] OSV Batch 1/17: 100 Pakete
2026-02-25 14:16:51 [INFO] OSV Batch 2/17: 100 Pakete
2026-02-25 14:17:04 [INFO] OSV Batch 3/17: 100 Pakete
2026-02-25 14:17:08 [INFO] OSV Batch 4/17: 100 Pakete
2026-02-25 14:17:10 [INFO] OSV Batch 5/17: 100 Pakete
2026-02-25 14:17:12 [INFO] OSV Batch 6/17: 100 Pakete
2026-02-25 14:17:12 [INFO] OSV Batch 7/17: 100 Pakete
2026-02-25 14:17:14 [INFO] OSV Batch 8/17: 100 Pakete
2026-02-25 14:17:15 [INFO] OSV Batch 9/17: 100 Pakete
2026-02-25 14:17:21 [INFO] OSV Batch 10/17: 100 Pakete
2026-02-25 14:17:26 [INFO] OSV Batch 11/17: 100 Pakete
2026-02-25 14:17:27 [INFO] OSV Batch 12/17: 100 Pakete
2026-02-25 14:17:30 [INFO] OSV Batch 13/17: 100 Pakete
2026-02-25 14:17:36 [INFO] OSV Batch 14/17: 100 Pakete
2026-02-25 14:17:59 [INFO] OSV Batch 15/17: 100 Pakete
2026-02-25 14:18:06 [INFO] OSV Batch 16/17: 100 Pakete
2026-02-25 14:19:19 [INFO] OSV Batch 17/17: 93 Pakete
2026-02-25 14:19:23 [INFO] OSV: 0 Vulnerabilities in 0 Paketen
2026-02-25 14:19:23 [INFO] ───────────────────────────────────────────────────────
2026-02-25 14:19:23 [INFO] Merge NVD + OSV...
2026-02-25 14:19:23 [INFO] JSON Report: /var/log/cve_scanner/cve_report_20260225_131606.json
2026-02-25 14:19:23 [INFO] CSV Report: /var/log/cve_scanner/cve_report_20260225_131606.csv
2026-02-25 14:19:23 [INFO] Summary CSV: /var/log/cve_scanner/cve_summary_20260225_131606.csv
============================================================
SCAN ABGESCHLOSSEN
============================================================
Sites gescannt: test
Gesamt Findings: 0
Betroffene Hosts: 0
Nach Schweregrad:
Nach Quelle:
Top anfällige Software:
Reports:
JSON: /var/log/cve_scanner/cve_report_20260225_131606.json
CSV: /var/log/cve_scanner/cve_report_20260225_131606.csv
Summary: /var/log/cve_scanner/cve_summary_20260225_131606.csv
============================================================