Skip to content
OpenAdvisories

Server scan

Scan a Linux server

Paste the list of installed packages from a Debian, Ubuntu, RHEL, Rocky, AlmaLinux, SUSE, openSUSE or Alpine system — or a container image. Every package is checked against the distribution's own security advisories for that release.

Processed in memory, never stored. A package list reveals what software runs on a host — it is not logged or kept.

1. Get the package list

Run one of these on the server (no root needed). It writes packages.txt, which you upload or paste above.

Any distribution

Detects dpkg, rpm or apk and includes /etc/os-release, so the release is recognised automatically.

{ cat /etc/os-release; if command -v dpkg-query >/dev/null; then dpkg-query -W -f='${db:Status-Abbrev}${source:Package} ${source:Version}\n'; elif command -v rpm >/dev/null; then rpm -qa --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n'; elif command -v apk >/dev/null; then apk list -I; fi; } > packages.txt

Debian, Ubuntu

Source package names and versions — what Debian and Ubuntu advisories use.

{ cat /etc/os-release; dpkg-query -W -f='${db:Status-Abbrev}${source:Package} ${source:Version}\n'; } > packages.txt

RHEL, Rocky, AlmaLinux, SUSE, openSUSE

Includes the epoch, which plain "rpm -qa" leaves out.

{ cat /etc/os-release; rpm -qa --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n'; } > packages.txt

Alpine

Lists each package with its origin (source) package.

{ cat /etc/os-release; apk list -I; } > packages.txt

2. Or scan straight from the server

Pipe the list to the API and get a plain-text report in the terminal. Drop ?format=text for JSON.

{ cat /etc/os-release; if command -v dpkg-query >/dev/null; then dpkg-query -W -f='${db:Status-Abbrev}${source:Package} ${source:Version}\n'; elif command -v rpm >/dev/null; then rpm -qa --qf '%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n'; elif command -v apk >/dev/null; then apk list -I; fi; } | curl -s --data-binary @- "https://www.openadvisories.org/api/scan/server?format=text"

3. Container images

The same list from a Docker or Podman image — replace IMAGE, for example nginx:1.25. Works for images with a shell (not distroless or scratch images).

docker run --rm --entrypoint sh IMAGE -c 'cat /etc/os-release; if command -v dpkg-query >/dev/null; then dpkg-query -W -f="\${db:Status-Abbrev}\${source:Package} \${source:Version}\n"; elif command -v rpm >/dev/null; then rpm -qa --qf "%{NAME} %{EPOCHNUM}:%{VERSION}-%{RELEASE}\n"; else apk list -I; fi' > packages.txt