VulnerableCode on Ubuntu 24.04 LTS

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

VulnerableCode - the open source vulnerability database, by cloudimg

Deploy a private, self-hosted VulnerableCode on your own Azure infrastructure in minutes - no manual installation, no default credentials, no third-party service. This image delivers VulnerableCode 40.0.1 fully installed, hardened, and reverse-proxied behind nginx, so your team can aggregate and query software package vulnerability data on infrastructure you control.

Why This Image Instead of Manual Installation

Installing VulnerableCode by hand means provisioning PostgreSQL, creating a Python virtual environment, installing the application and its dependencies, writing a gunicorn systemd unit, configuring an nginx reverse proxy, collecting static assets, and generating a secret key and administrator. This image eliminates that operational burden:

• Pre-configured PostgreSQL and gunicorn behind an nginx reverse proxy, all managed by systemd
• Secure by default: a unique Django secret key, application HMAC key, database password, administrator account and REST API token are generated on the first boot of every VM, so no default login ever ships
• A migrated but intentionally empty database, ready for you to populate with the vulnerability import pipelines you choose, on your own schedule
• Ongoing expert support: 24/7 cloudimg engineers handle upgrades, TLS termination, running and scheduling the import pipelines, and API integration

Use Case: A Self-Hosted Vulnerability Intelligence Database

VulnerableCode collects and normalises vulnerability advisories from many upstream sources into a single, package-centric model, then exposes it through a browsable web interface and a full REST API. Security, platform and engineering teams use it as a queryable database of which versions of which packages are affected by which vulnerabilities, correlating data across ecosystems from one place they own and control, and integrating that intelligence into their own tooling and CI.

Secure By Default

No administrator account and no shared secret ship in the image. On the first boot of every VM a one-shot service generates a fresh Django secret key, application HMAC key, database password, administrator account and REST API token, and records them in a file readable only by root. The REST API requires that token by default. This eliminates the default-credential exposure common in manual installations, and no two deployments ever share a secret. VulnerableCode is a Django application served by gunicorn on loopback (127.0.0.1:8000), fronted by nginx on port 80, with PostgreSQL as the primary database.

Features

Aggregate and correlate advisories from many upstream sources; browse packages and advisories in the web interface with their vulnerable status and computed risk score; look up affected and fixing packages by Package URL (PURL); and query everything through a documented REST API. Run and schedule the import and enrichment pipelines to keep the database current, and administer the instance through the bundled Django admin. Read the per-VM administrator password and API token from /root/vulnerablecode-credentials.txt after launch.

Licensing and Pricing

The VulnerableCode software is licensed under Apache-2.0 and is free; there is no per-seat or per-record fee. The vulnerability data it can import is licensed separately by its upstream sources. The cloudimg charge of 0.04 US dollars per vCPU hour covers packaging, security patching, image maintenance, and 24/7 expert support covering deployment, upgrades, TLS termination and API integration. VulnerableCode serves plain HTTP on port 80; terminate TLS in front of it with your own domain before production.

VulnerableCode is a trademark of its respective owner. This image is provided by cloudimg and is not affiliated with, endorsed by, or sponsored by the VulnerableCode project or nexB. Use of the name does not imply any affiliation with or endorsement by them.