Tech Version, CVE & Security-Header Check (Passive)

Check software you run for known problems — passively. Give a URL and a technology; it reads only what the page already serves (response headers, <meta generator>, <script src> URLs — the same bytes a browser receives), identifies whether that technology is present and at which version, looks that version up in public CVE databases (OSV.dev for libraries, NVD for server/CMS software), and reports the known CVEs — plus a passive security-header posture. Built to answer "is the version I'm running affected by anything, and are my hardening headers set?"

🔒 Passive and authorized-use only. It performs a normal read-only GET of the page — no payloads, no probing, no exploitation, no scanning of hidden paths or ports. Run it on assets you own or are authorized to test. A CVE affecting a version does not mean the target is exploitable (it may be patched, back-ported or mitigated); no CVEs does not mean it's secure. This is a version/known-vuln check, not a penetration test.

⚡ What it does

Known technologies:

jquery, bootstrap, lodash, vue, react, angular, axios, moment, wordpress, drupal, joomla, nginx, apache, php

📥 Input

{
  "urls": ["https://your-site.com"],
  "technologies": ["wordpress", "nginx", "jquery"],
  "includeSecurityHeaders": true
}

📤 Example output (real run, trimmed)

{ "check": "security-headers", "url": "https://wordpress.org/", "posture": "weak-headers",
  "presentHeaders": ["HSTS", "X-Frame-Options"],
  "missingHeaders": ["Content-Security-Policy", "X-Content-Type-Options", "Referrer-Policy", "Permissions-Policy"],
  "serverHeader": "nginx" }

{ "technology": "jquery", "technologyDetected": true, "detectedVersion": "3.4.1",
  "signal": "known-cves-for-version--review", "cveCount": 2,
  "cves": [ {"id": "CVE-2020-11022", "severity": "CVSS:3.1/...", "summary": "Potential XSS vulnerability in jQuery", "source": "OSV.dev"} ] }

Signals: known-cves-for-version--review, no-known-cves-for-version, version-not-identified, technology-not-detected.

💰 Pricing (pay-per-event)

• Tech checked — $0.02 per URL × technology checked. The security-header posture is included free.

💡 Use cases

• Developers / site owners: confirm the library/CMS/server version you run and its known CVEs, plus whether your security headers are set.
• Security / platform teams: a fast, passive version-and-CVE read across assets you own.
• Agents / CI: callable as an MCP tool for an authorized, non-intrusive check.

🔑 Keyless & agent-callable

No API keys, no accounts, no paid child Actors — just a read-only page fetch plus public OSV.dev and NVD.

🚀 Ready-made tasks (one click)

• Website CVE Check - Outdated Software Versions

🤖 For AI agents (MCP)

https://mcp.apify.com/?tools=actors,docs,centorprat/tech-version-cve-check

Loads as centorprat--tech-version-cve-check. Claude Code:

claude mcp add apify -- npx -y @apify/actors-mcp-server --actors centorprat/tech-version-cve-check