One dashboard for every vulnerability in your environment.
VulnTracker ingests scan data from Tenable, Qualys, ServiceNow, WebInspect, Burp Suite, AppDetectivePro, DBProtect, automatically cross-references every CVE against the CISA Known Exploited Vulnerabilities catalog, and turns eight tools and hours of manual work into one login and one click.
The problem
Vulnerability management shouldn't take four logins and a spreadsheet.
❌ Before
- 8 separate tools — Tenable, Qualys, ServiceNow, CISA KEV, WebInspect, Burp Suite, AppDetectivePro, DBProtect
- Manual KEV cross-reference: 2–3 hours per cycle
- Weekly report prep: 4–6 hours
- Remediation status lost on every re-upload
- No mapping between tickets and findings
- Code review requires a cloud AI subscription
✅ After
- 1 URL, 1 login
- KEV correlation automatic on every upload — instant
- Reports in 15 minutes with one-click export
- Status persists by fingerprint across every future scan
- Matched Devices cross-reference built in
- Local AI review via Ollama — no key, no cloud
Capabilities
Everything a vulnerability program needs, in one app.
From ingestion to executive reporting to CMMC compliance — 18 dashboards, one platform.
Multi-Source Ingestion
Upload Tenable HTML/CSV/XLSX, Qualys CSV, ServiceNow XLSX, WebInspect, Burp Suite, AppDetectivePro, and DBProtect files — or skip exports entirely with live API pulls.
CISA KEV Correlation
Every CVE is matched against the live Known Exploited Vulnerabilities catalog on ingest, with due dates and ransomware flags surfaced inline.
Threat Intelligence
MITRE ATT&CK and OWASP Top 10 exposure — the global CISA KEV catalog fused against what's actually running in your environment, not just the reference feed.
Attack Path Analysis
Ranked chains from exposed entry points to your most critical assets, built from severity, KEV correlation, and exploit availability — with a filterable entry-to-impact flow diagram.
Executive Dashboard
SPRS score, CMMC readiness %, KEV threat snapshot, MITRE ATT&CK radar, OWASP Top 10 charts — exportable to PDF, CSV, and PNG in one click.
Remediation Tracking
Per-finding status — Open, In Progress, Remediated, Accepted Risk, False Positive — persisted by fingerprint so re-uploads never wipe your work.
AI Remediation
Real fix guidance per finding — 7 script formats (Bash, PowerShell, Ansible, Chef, Puppet, Terraform, Kubernetes) built from the actual extracted product and version.
Aging & SLA
Days-open calculated per finding with color-coded SLA breach indicators, so the oldest criticals never hide in the noise.
CMMC Compliance Suite
SSP, POA&M, Control Requirements Matrix, Policy & Procedure tracker, evidence management, and a one-click readiness report — NIST SP 800-171 aligned.
AI Code Review — Local
Three specialized agents (Security · CMMC · Quality) powered by Ollama on-premises. No API key, no cloud — your code never leaves the network.
Live API Pulls
Connect directly to Tenable.io, Qualys VMDR, ServiceNow, and WebInspect APIs to import findings without touching an export button.
RBAC + CAC/PIV Login
Five roles enforced on every request, full admin user management, and optional DoD smart card authentication via mutual TLS.
Product tour
See it in action.
Click any tab to explore the dashboards.
Security posture
A security tool that takes its own medicine.
Security reviews were run before launch, after launch, and again with each module addition — 41 findings identified, 40 fixed in code, 1 requires user action (key rotation).
- 🔒Werkzeug scrypt password hashing · 12-char complexity policy (NIST 800-171)
- 🛡️CSRF protection on all forms and fetch calls · rate-limited login
- 🍪Session fixation prevention — nonce rotation + 8-hour timeout · HttpOnly / SameSite cookies
- 🌐SSRF protection on all outbound API calls — scheme + DNS/IP validation
- 📄Security headers on every response — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy
- 📁Upload allowlist + filename sanitization — path traversal stripped
- 🤖AI runs on-premises via Ollama — code never transmitted externally by default
- 🔌Air-gapped ready — file uploads processed locally; all external API integrations are optional
Return on investment
~10 hours back, per analyst, per week.
Weekly report prep
KEV cross-reference
New scan ingestion
Consolidated platforms
AI code review (Ollama local)
Open platform, no per-seat cost
Roadmap
Where it's headed.
Production hardening
Gunicorn deployment done — one-command installers provision it as a system service on Windows, macOS, Debian, and RHEL. Still ahead: nginx + HTTPS (operator setup step), scheduled API pulls, and email alerts on new Critical / KEV findings.
Integrations
Slack webhook alerts · SAML / SSO integration with Okta and Azure AD · cloud/identity connectors for cross-domain Exposure Management (AWS, Azure AD, GCP).
Intelligence
AI-assisted vulnerability prioritization · multi-tenant support · Ollama model selection UI.
Quickstart
Running in two commands.
Python 3.10+ is the only prerequisite. A random admin password is generated and printed on first run.
# Install dependencies
pip install -r requirements.txt
# Start the server → http://localhost:5001
python app.pyInstall & launch
Two commands. The SQLite database is auto-created on first run — no setup scripts.
Log in
Use the one-time admin password printed to the console, then change it from the top bar.
Upload a scan
Drop a Tenable, Qualys, or ServiceNow export — KEV correlation runs instantly.
Go live
Wire up Tenable.io, Qualys VMDR, ServiceNow, or WebInspect API credentials and pull on demand.
README.mdINSTALL.mdUSER_GUIDE.mdARCHITECTURE.mdSECURITY_FINDINGS.txtReady to get started?
Reach out and we'll get VulnTracker running in your environment.