A server vulnerability scanner that reads the software installed on your servers.

01  /  what it is

It reads the software installed on each server.

Termalin reads the list of software installed on the server, from the inside, over the Connector you already run, and matches that list on Termalin's side against known vulnerabilities. You get the exact package and version that is affected, whether the vulnerability is being used in attacks, and the command to fix it. It looks at what is installed; it does not probe ports or scan your network.

• ▸From inside, over the Connector. The same keyless Connector that carries the terminal and monitoring reads the installed-software list. There is no scanner to deploy, no second agent and no open port.
• ▸It checks the servers you have connected. It reads installed software over each Connector, and leaves alone any machine without one.
• ▸Only names and versions are looked up. The list of installed software and your applications' lock files are read; only package names and versions are matched against public vulnerability data, never which server or account they came from.
• ▸In the cabinet and to AI apps. Findings appear on the Security page in the web cabinet, and reach Claude, ChatGPT and other AI apps through the updates_list tool on the hosted MCP endpoint.

02  /  what is checked

Everything installed, from the OS to your app dependencies.

• ▸Linux distributions. Ubuntu, Debian, AlmaLinux, Rocky, RHEL, CentOS, Alpine, SUSE Linux Enterprise and openSUSE, and Amazon Linux — each against its own security data.
• ▸Running containers. Docker, containerd/Kubernetes, Podman and LXC, up to 30 per server, each checked by its own distribution. Their package lists are read from outside — nothing is run inside a container.
• ▸Application dependencies. Lock files in /var/www, /srv, /opt, home folders and /app: npm (package-lock, yarn, pnpm), composer.lock, Cargo.lock, Python (requirements.txt pins, poetry.lock), Go (go.sum), Gemfile.lock, gradle.lockfile, and Java jar/war/ear archives — including Spring Boot fat jars.
• ▸Runtimes installed outside the package manager. Node.js, PHP, nginx, Python, Redis, Go, PostgreSQL, MariaDB, MongoDB, Apache, Java and .NET.
• ▸Windows servers. The build against Microsoft's security updates of the last three years — which KB fixes each CVE, which are exploited — and the release's support; SQL Server, Exchange, Office (Click-to-Run) and .NET; and the installed programs.
• ▸macOS. The OS version against its branch's latest patch, Homebrew packages and applications.
• ▸About eighty programs and web apps no distribution ships, by their whole CVE history — WinRAR, 7-Zip, browsers, Zimbra, WordPress, Joomla, Drupal, Nextcloud, phpMyAdmin, Moodle, Jenkins, GitLab, Grafana, Keycloak, Confluence, Jira, Proxmox and more.

03  /  sources

Where the vulnerability data comes from.

The matching happens on Termalin's side, against several sources, so a finding carries more than a CVE number.

• ▸OSV.dev — the distributions' own security data.
• ▸CISA KEV — vulnerabilities known to be used in attacks. These are shown first.
• ▸FIRST EPSS — the chance a vulnerability is exploited in the next 30 days.
• ▸Ubuntu and Red Hat workarounds — what to do when there is no fix yet.
• ▸Node.js security advisories and endoflife.date — for runtimes, and for branches past their support.
• ▸Microsoft (MSRC) — Windows, SQL Server, Exchange, Office and .NET.
• ▸The CVE List — for an early warning the hour a high or critical CVE is published, before the distribution's own data catches up.

04  /  how to fix

Every finding says what to do.

Each finding comes with the fix for that server. Nothing is installed automatically — you or the AI app applies it only when you agree.

• ▸OS packages. The update command for that server's package manager, and whether a reboot (a new kernel) or a service restart is needed — with the command.
• ▸No fix yet. A fixed build still in testing, or the vendor's workaround (Ubuntu, Red Hat) — turn a module off, add a firewall rule.
• ▸Containers. Update the image and recreate the container.
• ▸Application dependencies. The update command to run in the lock file's folder, then redeploy.
• ▸A runtime that came inside another program (the Node.js in a GitHub Actions runner, VS Code Server, a snap) — update that program, don't replace the file.
• ▸An end-of-support branch. Move to a supported one.

05  /  the Security page

Every server's vulnerabilities, in one place.

Open termal.in/account and the Security page (the shield icon) gathers it all.

• ▸Tiles — used in attacks, critical, with a fix, reboot needed, security updates waiting.
• ▸A "Fix first" list — what is used in attacks or critical and already has a fix, with the command to copy.
• ▸Every server with its counts, and each server's full list — its own packages first, then each container under its image.
• ▸CVSS score and exploit chance on each finding, and the full description on request.

06  /  alerts

Alerts for vulnerabilities used in attacks.

An alert fires as soon as a vulnerability that is used in attacks and already has a fix appears on a server, through the usual channels: email, Telegram, push and webhook. Other CVEs are listed on the Security page but do not raise an alert.

• ▸A nightly summary for servers checked for the first time (a Connector added that day): which have vulnerabilities used in attacks, and how many.
• ▸Gentle reminders. New ones at most once a day, a reminder after a week, then monthly — and a "fixed" message when the last one is gone.
• ▸Its own kind in the alert settings, so you can mute it without touching the rest.

07  /  AI apps

"Which of my servers are exposed, and how do I fix them?"

Through the hosted MCP endpoint, an AI app reads the same findings with two read-only tools. updates_list returns the pending security updates and the known vulnerabilities with their fix and exploit chance — for one host, a tag, or all servers; cve answers "which of my servers have CVE-2026-…?". Example prompts:

• ▸"Which of my servers are exposed to vulnerabilities used in attacks, and how do I fix them?"
• ▸"Do any of my servers have CVE-2024-3094?"
• ▸"Patch the critical ones on prod, one server at a time, and check after."

Nothing is installed without your say-so, and a connected app only sees the servers its command rule allows.

08  /  light on your servers

One inventory a day, at the lowest priority.

The check is built to stay out of the way.

• ▸Once a day, the full list of installed software is read at the lowest CPU and disk priority.
• ▸Hourly, only the few packages with a fix waiting are looked at, in a single query.
• ▸All matching happens on Termalin's side. New advisories are matched against the stored lists every hour without asking the server, so a new CVE shows up within the hour — and an installed fix shows as closed within the hour too.
• ▸Only package names and versions are looked up, never which server or account they came from.

09  /  plans

Part of Pro and Team.

The check needs a Connector, and Connectors are a paid-plan feature — so vulnerability checks come with Pro and Team, and the 14-day Pro trial includes them. They are not on Free. See pricing →