Documentation › Using Steward IT Census
Vulnerabilities
Vulnerabilities shows which of your computers are missing security fixes: Linux packages with known vulnerabilities, Windows computers missing Microsoft security updates, and outdated versions of popular third-party applications such as browsers, PDF readers, remote-support and VPN tools. Vulnerabilities that attackers are actively using, according to the US Cybersecurity and Infrastructure Security Agency (CISA), are flagged Exploited and listed first.
Only vulnerabilities with a fix available are listed: each finding tells you what to install. Steward IT Census does not report unfixed issues or "won't fix" decisions by the distribution, which keeps the list actionable and free of noise.
What is checked#
| Operating system | Checked against | What you install |
|---|---|---|
| Windows 10, 11 and Windows Server 2012–2025 | Microsoft's monthly security updates (last 12 months by default) | The listed cumulative update (KB) |
| Debian (stable releases) and Raspberry Pi OS | Debian security tracker | Package updates (apt upgrade) |
| Ubuntu (LTS and interim releases) | Ubuntu security notices | Package updates (apt upgrade) |
| Alpine Linux | Alpine security database | Package updates (apk upgrade) |
| Rocky Linux, AlmaLinux, Red Hat Enterprise Linux | The distribution's security advisories | Package updates (dnf upgrade) |
| Arch Linux and Arch-based distributions (EndeavourOS, CachyOS, Garuda, Manjaro…) | Arch Linux security tracker | Package updates (pacman -Syu) |
| Third-party applications on Windows and macOS (see below) | US National Vulnerability Database (NVD); Microsoft for Edge | A newer version of the application |
Not covered: applications that aren't on the list, Microsoft Office, macOS itself, network devices, Debian testing/unstable, end-of-life Debian and Raspberry Pi OS releases (10 buster, 11 bullseye and older): Debian no longer publishes fixes for them, so the feeds have no data, and the asset shows end of life instead (it also appears in the End-of-life operating systems report), and fixes that are only available through Ubuntu Pro (ESM). The Assets not assessed for vulnerabilities report lists computers that couldn't be checked, and why.
How matching works#
- Windows: the installed build and update revision (for example
22631.3447) is compared with the build each Microsoft update brings. A computer below a fixed build is missing that update. Windows updates are cumulative, so installing the newest listed update fixes everything. - Linux: each installed package (by its source package, the way the distributions publish advisories) is compared with the version that fixed each vulnerability, using the distribution's own version rules. When several versions of a package are installed (old kernels are often kept), only the newest counts. A new kernel only protects the computer after a reboot.
Computers are checked again automatically after every inventory and whenever new vulnerability data arrives.
Census agent version. Linux computers inventoried by a Census agent older than 0.10 are still checked, but by binary package name only. Update the agent (or let an SSH scan inventory the computer) for complete results.
Third-party applications#
123 popular applications are checked on Windows and macOS computers:
- Browsers and mail: Chrome, Firefox, Edge, Safari (Mac), Thunderbird
- Office, PDF and passwords: Adobe Acrobat and Reader, Foxit Reader and Editor, PDF-XChange Editor, LibreOffice, Apache OpenOffice, WPS Office, Notepad++, KeePass, 1Password, Bitwarden, Nitro PDF Pro, calibre, Keynote and Pages (Mac)
- Adobe Creative Cloud: Photoshop, Illustrator, InDesign, Premiere Pro, After Effects, Bridge, Animate, Lightroom Classic, Dreamweaver, Audition, Media Encoder, InCopy, Substance 3D Painter, Designer, Sampler and Stager, and the Creative Cloud app
- Meetings, chat and remote support: Zoom, Mattermost, TeamViewer, AnyDesk, ScreenConnect, Splashtop, TightVNC, TigerVNC, Devolutions Remote Desktop Manager
- VPN: FortiClient, OpenVPN, OpenVPN Connect, Ivanti Secure Access Client, SonicWall NetExtender, Tailscale, Zscaler Client Connector, Proton VPN
- Computer maker tools: Dell Command | Update, Dell SupportAssist (home and business), HP Support Assistant, Lenovo System Update, Intel Driver & Support Assistant, Dell Digital Delivery, Dell Display Manager, Dell Peripheral Manager, Dell Power Manager, Dell Optimizer, Dell Command | Monitor, MSI Center, Razer Synapse
- File transfer, archives and media: 7-Zip, WinRAR, PuTTY, WinSCP, FileZilla, Nextcloud, VLC, Greenshot, iTunes, iCloud, ImageMagick, GarageBand (Mac)
- IT and developer tools: Wireshark, Git, Node.js, PowerShell 7, Visual Studio Code, Docker Desktop, VMware Workstation and Tools, VMware Fusion (Mac), Microsoft .NET, Go, MobaXterm, Sourcetree, TortoiseGit, GitHub CLI, pgAdmin 4, OpenSSL, Windows Subsystem for Linux, PowerToys, Azure Storage Explorer, Xcode and iTerm2 (Mac)
- Servers on Windows: Veeam Backup & Replication, PaperCut NG and MF, Apache Tomcat, MySQL Server, PostgreSQL, MariaDB, MongoDB, SolarWinds Serv-U, Splunk Enterprise and Universal Forwarder, Plex Media Server, Jellyfin Server, PRTG Network Monitor, Tenable Nessus
- Security agents: Bitdefender Total Security and Endpoint Security Tools, Tenable Nessus Agent, Rapid7 Insight Agent, Elastic Agent, Cisco Secure Endpoint
Security › Applications checked lists every one with how many of your computers have it and how many are vulnerable.
Each application is matched by hand: the name it shows in Control Panel (or the Applications folder on a Mac), its product name in the NVD, and how to read its version number (for example the OpenVPN installer reports 2.6.1201 for version 2.6.12). That's what keeps false alarms low, and it's also why programs that aren't on the list are not checked. Microsoft .NET is checked per version: computers usually have several (8.0 and 9.0, for example) installed side by side, and each one that needs an update is listed, as "Microsoft .NET (8.0)". The asset's Vulnerabilities tab says which of its programs were checked.
Some products are deliberately not on the list because their public data can't give reliable answers (for example Oracle Java, VirtualBox and several VPN clients list only individual affected versions; Slack, Microsoft Teams and OneDrive have no usable version ranges; AutoCAD and JetBrains IDEs are listed by year while Windows reports an internal build number); an application that is checked but shows nothing really has no known fixed vulnerabilities.
Only vulnerabilities with a fixed version are listed. NVD entries that only say "up to and including version X" usually mean there is no fix yet, so they're ignored, except for vendors whose entries are known to name the last vulnerable release (Foxit). Brand-new CVEs appear once the NVD has analyzed them, usually within a few days.
The Vulnerabilities page#
- Tiles: actively exploited vulnerabilities, the number of Critical / High / Medium vulnerabilities and how many assets have them, affected assets, and accepted risks. Click a tile to filter.
- Windows updates / Linux packages / Applications tabs, a search (CVE, advisory, title or package), a minimum severity and Exploited only.
- Export CSV exports every finding (one row per asset and vulnerability) for the current filter.
Severity comes from the CVSS base score (Critical 9.0+, High 7.0+, Medium 4.0+, Low), or from the vendor's rating when there is no score.
Click a vulnerability to see its description, CVE links, CISA details (date added, the federal fix-by date and whether it is used by ransomware) and every affected asset with the installed and fixed versions.
Assets ranks computers by open vulnerabilities, actively exploited first.
On each asset#
A Linux computer with nothing to fix shows No known vulnerabilities with an available fix, with the number of installed packages checked and how many of them have a security history in the feed. On rolling-release distributions such as Arch Linux and CachyOS this is the normal result for an up-to-date computer.
The Vulnerabilities tab of an asset shows:
- Missing Windows updates: each update the computer is missing, the build it brings and how many vulnerabilities it fixes;
- Packages to update (Linux): each package to upgrade, the version to upgrade to, and how many vulnerabilities that fixes;
- Applications to update: each third-party application to update and the version that fixes its vulnerabilities, followed by the list of applications that were checked on this computer.
- Every open vulnerability, and the accepted ones.
Accepting a risk#
Sometimes a vulnerability doesn't apply to you (the vulnerable feature isn't used, a firewall blocks it) or the fix must wait. Click Accept risk on a vulnerability or on one asset's finding, choose what it applies to and give a reason:
- Only this asset, assets in a group (static or dynamic groups; the exception follows the group's members) or all assets;
- an optional expiry date, after which the findings count again.
Accepted findings are hidden from counts, the dashboard, reports and alerts, and listed under Accepted risks. Exceptions lists every exception with who created it, why, and how many findings it covers; remove one to make its findings count again. Expired exceptions can be deleted automatically under Cleanup & retention.
Feeds#
The server downloads public vulnerability data once a day (adjustable), only for the operating systems your assets run. When a computer with a new operating system is inventoried, its feed is downloaded within about ten minutes:
| Feed | Source |
|---|---|
| Debian, Alpine, Rocky Linux, AlmaLinux, Red Hat | OSV (osv-vulnerabilities.storage.googleapis.com) |
| Arch Linux | Arch Linux security tracker (security.archlinux.org) |
| Ubuntu | Canonical (security-metadata.canonical.com) |
| Microsoft (Windows and Edge) | Microsoft Security Response Center (api.msrc.microsoft.com) |
| Third-party applications | NVD (services.nvd.nist.gov), only for the applications installed on your computers |
| Actively exploited (KEV) | CISA (www.cisa.gov) |
These are plain downloads of public files: nothing about your network or assets is sent. The first download for Debian is about 75 MB; after that only changes are fetched. Microsoft publishes one document per month (about 20 MB each). The NVD limits how fast data can be downloaded, so the first download of third-party application data takes a few minutes (Chrome alone has over 6,000 CVEs); after that one small request a day is enough. A free NVD API key, entered under Configuration › Vulnerabilities & compliance, makes the first download about ten times faster.
Security › Feeds shows each feed's status, records and when it was last checked and updated. Administrators can Check for updates now, do a Full reload and upload feed files.
The download options are under Configuration › Vulnerabilities & compliance: turn automatic downloads off, change how often feeds are checked, turn individual feeds off, choose how many months of Microsoft updates to check, and enter the NVD API key.
Servers without internet access#
Download the files on another computer and upload them on the Feeds page:
| Feed | File |
|---|---|
| Debian, Alpine, Rocky Linux, AlmaLinux, Red Hat | https://osv-vulnerabilities.storage.googleapis.com/<name>/all.zip (for example .../Debian/all.zip, .../Rocky%20Linux/all.zip) |
| Ubuntu | https://security-metadata.canonical.com/osv/osv-all.tar.xz |
| Microsoft | https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep (one per month; request it with the header Accept: application/json and save it as .json) |
| Actively exploited | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
| Arch Linux | https://security.archlinux.org/issues/all.json |
| Third-party applications | https://nvd.nist.gov/feeds/json/cve/2.0/nvdcve-2.0-<year>.json.gz: one file per year (the last five to ten years cover current versions), then nvdcve-2.0-modified.json.gz for recent changes |
Upload newer files from time to time to keep the results current.
Alerts and reports#
- Alert type Actively exploited vulnerability found (CISA list) (see Alerts) emails you when a computer gets an exploited vulnerability, or when CISA adds a vulnerability you already have to its list.
- Reports in the Vulnerabilities category: Assets with actively exploited vulnerabilities, Critical vulnerabilities, Assets by open vulnerabilities, Missing Windows updates and Assets not assessed for vulnerabilities. Like any report they can be added to the dashboard or emailed on a schedule.
- The dashboard's Vulnerabilities panel shows the key numbers.
Who can see it#
Administrators, and custom roles with the Vulnerabilities permission (see Configuration), which also allows accepting risks. Viewers and other roles don't see the Vulnerabilities pages (in the Security menu), the asset tab or the vulnerability reports. Only administrators can change feed settings or upload files.