UltraViolet: your own Shodan, in Docker, with CVE/KEV/EPSS

Been hacking on UltraViolet for a while - basically network discovery and search you run yourself. Shodan vibes, except the data sits in your Postgres behind a normal Docker Compose stack. Not SaaS, not multi-tenant. One install, your hardware.

You give it CIDRs you're actually allowed to hit (please only stuff you own or have written permission for). It finds open TCP/UDP ports, then probes a bunch of protocols - HTTP/HTTPS with bodies, titles, tech guesses, favicon hash, robots.txt, security.txt; TLS with certs, JARM, JA3S/JA4S; mail, LDAP, common DBs and queues; some ICS/SCADA and IoT stuff too. Roughly ~100 probe types last I counted. Discovery can be the built-in scanner or masscan/zmap if you want it faster.

Results go into Postgres. Search is full-text over banners, HTTP bodies, TLS bits, DNS, CVEs - handy when you're trying to answer "where is this nginx version still hanging around" without living in spreadsheets.

Why I wanted this:

perimeter / inventory that doesn't rot in a shared cloud account
rescan diffs (new, gone, changed) plus websocket updates while scans run
CVE side is local NVD mirror + fingerprint matching, with KEV and EPSS layered on
offline tarball exists if you need air-gap (images, optional CVE seed, GeoIP db)
saved searches can alert to logs or webhooks, with cooldowns so one chatty host doesn't wreck your day

What it is not: an exploit scanner. No L2 mapping, no agents everywhere, no "scan the whole internet" product angle. Single tenant on purpose.

Stack is boring on purpose - Go API + worker, React UI, Postgres 16. RBAC (viewer / operator / admin), JWT + refresh, audit log, rate limits, schedules, Prometheus metrics, optional Grafana profile. Dev is clone, secrets in service-env, make dev, UI on :3000. Production mode kills the default admin/admin thing.

Repo: https://github.com/yakushstanislav/UltraViolet

Impact

UltraViolet itself is not a vulnerability or exploit but a tool for network discovery and vulnerability data correlation. It does not introduce a security vulnerability but could be misused if deployed improperly or used to scan unauthorized networks, which may violate policies or laws. There are no known exploits or vulnerabilities associated with UltraViolet reported in the provided data. The impact is primarily operational, providing enhanced visibility into network assets and potential vulnerabilities for authorized users.

Defensive guidance

This is not a vulnerability requiring patching. Users should ensure they deploy UltraViolet securely by following best practices outlined in the documentation: restrict scanning to authorized CIDRs, secure secrets and credentials, change default passwords, enable TLS termination properly, configure RBAC appropriately, and maintain backups. No official patches or fixes are applicable as this is a tool, not a vulnerability. Users must comply with legal and organizational policies regarding network scanning.

Summary

UltraViolet is a self-hosted network reconnaissance platform that enables users to scan authorized IP ranges for open ports and services using a variety of protocol probes. It stores results in a local PostgreSQL database and provides full-text search capabilities over collected data, including banners, HTTP content, TLS fingerprints, and CVE information. The tool integrates local vulnerability data sources such as the National Vulnerability Database (NVD), CISA KEV, and EPSS for risk assessment without relying on cloud services. It is designed for single-tenant use with Docker Compose deployment, emphasizing data control and offline operation. UltraViolet includes features like scan scheduling, delta tracking of scan results, WebSocket updates, RBAC, JWT authentication, audit logs, and metrics integration. It explicitly advises scanning only networks for which the user has authorization and does not include exploit scanning or agent deployment.

UltraViolet: your own Shodan, in Docker, with CVE/KEV/EPSS

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 2 Jun 2026, 18:18 UTC

Technical details

References

Community reviews