debsecan

debsecan --suite <suite>

Lists Debian/Ubuntu packages with known vulnerabilities using debsecan, the CVE check against security repositories.

Run it when you need to know which installed packages have known unpatched CVEs: debsecan queries the Debian (or Ubuntu) vulnerability database and lists affected packages with their CVE and status (patch available or not). It's the vulnerability management tool in Debian: the snapshot of host exposure by packages, complementary to patch management. In hardening and IR, reviewing with debsecan answers 'which CVEs affect this host?' — the vulnerable package the attacker could have exploited.

Don't use it as a complete vulnerability inventory: debsecan covers packages from the distro repository — third-party software (binaries, custom applications, containers) doesn't appear; for that, use application scanners. The distro CVE database updates with delay: very recent vulnerabilities may not be included. And note: the presence of a CVE doesn't mean exploitability — a vulnerable package with mitigation applied or without an accessible exploitation path isn't an imminent risk; prioritization requires context. For continuous tracking, managed scanners (Trivy, Nessus) or pipeline integration are the option; debsecan is the point-in-time host check.