Base
Hardened build
minimal ports, security patches applied at build time
VulnerableCode on Ubuntu 24.04 LTS
Azure
Security
VulnerableCode, an open source, self hosted database of software package vulnerabilities with a REST API, ready to serve the moment it boots.
Overview
VulnerableCode is a free and open database of software package vulnerabilities and the tooling to aggregate and correlate them. Built by nexB and the AboutCode project, it collects and normalises advisories from many upstream sources into a single package centric model, then exposes it through a browsable web interface and a full REST API, so teams can look up which versions of which packages are affected by which vulnerabilities and integrate that intelligence into their own tooling.
It suits security, platform and engineering teams who want a queryable vulnerability database they host and control themselves, rather than depending on a third party service, and who want to correlate package data across ecosystems from one place.
Why the cloudimg image
cloudimg delivers the VulnerableCode web application fully installed and reverse proxied behind nginx, with the gunicorn application server and PostgreSQL already running, so the web UI and REST API answer within minutes of launch. The image is secure by default: no administrator and no shared secret ship in it, and on the first boot of every instance a fresh Django secret key and application HMAC key are generated, the database is initialised empty, and a unique administrator account plus a REST API token are created and written to a file only the root user can read, so no two deployments ever share a login. The database is migrated but intentionally empty so you run the vulnerability import pipelines you choose, on your own schedule. The image is hardened, fully patched and pinned to a known release, and every deployment is paired with a step by step deploy guide and backed by 24/7 support.
Common uses
- A private, self hosted vulnerability intelligence database with a REST API
- Correlating package vulnerability data across many upstream advisory sources
- Backing internal security tooling and CI with a queryable vulnerability API you own
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.