OpenVAS, Nuclei and Trivy are often lumped together as “free vulnerability scanners”, but they answer different questions. We compared them from their documentation, licences and advisories, checked on 22 October 2026, and found that the most useful lesson of the year came from the scanner that was itself compromised.
Three tools, three jobs
This is a documentation-based comparison, not a benchmark. We have not run head-to-head detection tests and we do not give scores. The short version is that these tools are rarely substitutes for each other.
| OpenVAS (Greenbone Community Edition) | Nuclei | Trivy | |
|---|---|---|---|
| What it scans | Hosts and services on a network | Web apps, APIs and services, by template | Container images, file systems, repositories, IaC, Kubernetes |
| Current release | openvas-scanner 23.52.3 (21 October 2026); gvmd 26.42.0 (14 October 2026) | 3.11.1 (8 August 2026) | 0.76.1 (21 October 2026) |
| Licence | GPL-2.0 (scanner); AGPL-3.0 (gvmd) | MIT | Apache-2.0 |
| Content | Greenbone Community Feed | Community YAML templates | Public vulnerability databases |
| Paid upgrade | Enterprise Feed | ProjectDiscovery cloud platform | Aqua commercial products |
| Typical user | IT team scanning its own estate | Pen testers and bug bounty hunters | DevOps teams in CI pipelines |
OpenVAS: the network scanner, with a thinner free feed
OpenVAS is the classic authenticated network scanner, and the Greenbone Community Edition remains the most complete free option for scanning a whole estate. The scanner (opens in a new tab) is GPL-2.0 and the management daemon (opens in a new tab) is AGPL-3.0.
The catch is the content, not the code. Greenbone’s feed comparison (opens in a new tab) says: “The COMMUNITY FEED is free and gives you basic coverage to get started with OPENVAS.” Its table shows the free feed covers widely used standard software and operating systems, with Microsoft Office and Ubuntu Linux as examples, and BSI IT-Grundschutz checks. It does not cover enterprise software and network gear, naming Cisco, Microsoft Exchange and Palo Alto Networks, or compliance checks against CIS Benchmarks, or EPSS-based prioritisation.
That gap matters. Firewalls, VPN gateways and Exchange servers are exactly what attackers have been exploiting at the network edge. A small organisation relying on the Community Feed should not assume a clean report means its edge devices are clean.
Nuclei: fast, flexible and not gentle
Nuclei (opens in a new tab) is an MIT-licensed engine that runs YAML templates, many of them written by its community, as its template documentation (opens in a new tab) describes. It is quick, and new templates often appear soon after a high-profile vulnerability is disclosed. That is its main appeal.
It is also active. Many templates send real exploit-style payloads to check whether something is vulnerable. Run it only against systems you own or have written permission to test. Sending Nuclei at somebody else’s server is not research; it is something the Computer Fraud and Abuse Act, and the UK’s Computer Misuse Act, have views on.
Nuclei can also run “code” templates that execute scripts on the machine running the scan. Its documentation (opens in a new tab) warns of the risk and advises: “To ensure the integrity of the code in your templates, be sure to sign your templates using the Template Signing methods.” Code templates must be enabled explicitly. Leave them off unless you know exactly what you are running.
Trivy: the scanner that became the supply chain
Trivy (opens in a new tab), Apache-2.0, is the default choice for scanning container images and infrastructure code in CI. Which is precisely why its compromise in March deserves a place in any review.
According to the project’s advisory, GHSA-69fq-xp46-6×23 (opens in a new tab) (CVE-2026-33634), on 19 March 2026 “a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits.” On 22 March, malicious v0.69.5 and v0.69.6 images appeared on Docker Hub.
The advisory traces this to an earlier incident in February. After the first disclosure on 1 March, it says, credential rotation “was not atomic (not all credentials were revoked simultaneously)”, which may have let the attacker keep access. Where exfiltration failed and a GitHub token was supplied to the action (INPUT_GITHUB_PAT), the malware could create a public repository called tpcp-docs on the victim’s GitHub account and upload stolen data to it.
There is an uncomfortable detail for anyone who thought pinning solved everything. The advisory explains that pinning trivy-action to a commit from before 9 April 2025 gave you a safe trivy-action, which would then fetch a malicious setup-trivy if run during the exposure window. Pinning protects what you pin, and nothing that it fetches.
Microsoft published detection and investigation guidance (opens in a new tab) on 24 March. The advisory lists trivy v0.69.2 and v0.69.3, trivy-action 0.35.0 and setup-trivy 0.2.6 as known-safe versions at the time of the incident; current releases have since moved on.
What to do with this
- Pick by question. OpenVAS for “what is exposed on my network”, Nuclei for “is this specific service vulnerable to that specific bug”, Trivy for “what am I about to ship”.
- Know the feed’s limits. If you use the Greenbone Community Feed, check edge devices and Exchange by other means.
- Get permission in writing before running Nuclei against anything you do not own.
- Treat scanners as privileged software. Pin actions and images to full commit SHAs or digests, check what pinned components fetch, and give CI jobs only the secrets they need.
- If you ran Trivy in CI in March 2026, check the advisory’s exposure windows, rotate any secrets that pipeline could see, and look for tpcp-docs repositories in your organisation.
A vulnerability scanner sees everything you build and holds the keys to do so. That makes it one of the most valuable things in the pipeline to an attacker, which is worth remembering the next time it is installed with a single line copied from a README.
To collect and search the findings, see free SIEMs for small teams compared. For what to scan for first, check the Alert Tracker. More is in Product Reviews.
Sources
- Greenbone openvas-scanner v23.52.3 (opens in a new tab)
- Greenbone gvmd v26.42.0 (opens in a new tab)
- Greenbone: Feed comparison (opens in a new tab)
- Nuclei v3.11.1 (opens in a new tab)
- ProjectDiscovery: Templates introduction (opens in a new tab)
- ProjectDiscovery: Code protocol templates (opens in a new tab)
- Trivy v0.76.1 (opens in a new tab)
- Trivy advisory GHSA-69fq-xp46-6×23 (CVE-2026-33634) (opens in a new tab)
- Microsoft Security Blog: Detecting, investigating and defending against the Trivy supply chain compromise (opens in a new tab)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)