nmap --script vuln

nmap --script=vuln -p- <target>

Scan for known vulnerabilities in services using NSE scripts from the 'vuln' category.

After a port and version scan, to get a list of potential vulnerabilities without having to launch exploits. Nmap scripts check for known CVEs like Heartbleed, Shellshock, SMBv1, etc. It's a non-intrusive scan that gives you priorities.

If the target has a WAF or IDS that detects NSE script traffic. Also if you need a deeper analysis, prefer tools like Nessus or OpenVAS.