nmap-vulners is an Nmap NSE script that enriches service scans with vulnerability data by cross-referencing detected software against the Vulners database to surface CVEs, CVSS scores, and known exploits.
The tool solves the problem of translating Nmap's software identification into actionable security intelligence. When you run a service scan with the `-sV` flag, Nmap identifies what software is listening on each port. The script takes those identifications, queries them against Vulners to find known vulnerabilities, and displays results ranked by exploitability rather than CVSS score alone, so threats that are actively being weaponized appear first. It performs fingerprinting from HTTP responses and checks every detected CPE against the Vulners database. The script works without an API key, though a free key enriches the results with additional detail.
Anyone running Nmap service scans for security assessment should consider this tool. It suits penetration testers, vulnerability scanners, and security teams who want to move quickly from "what's running" to "what's broken about it" in a single command. The installation is straightforward on macOS, Linux, Kali, and WSL via a one-line installer, and on Windows via PowerShell. The script integrates directly into Nmap's workflow, requiring no separate tools or databases to maintain locally since it downloads fingerprint data at scan time and writes nothing to disk.
The project shows active maintenance with clear documentation covering installation, usage, output interpretation, and troubleshooting. The README provides detailed guidance on how results differ with and without an API key, explains the ranking system, and includes sections on scanning politely and understanding how fingerprints are sourced. The codebase is written in Lua and distributed as a single file, making it easy to audit, modify, and deploy from a checkout if needed.
