There is a list of CVEs available via NVD or similar, however the challenge for a scanner is "how do I know if the binaries I'm seeing have been patched" The c

There is a list of CVEs available via NVD or similar, however the challenge for a scanner is "how do I know if the binaries I'm seeing have been patched" The common way to do that is to lean on the linux distribution's package management system, which is why the way it works varies from distro to distro.