VulnScan
What on this Windows machine has a known CVE? Run one script, drop the file, and get the list: which applications, which versions, which CVEs, and which are on CISA's actively-exploited list.
The vulnerability index is downloaded to you. Your software inventory is never uploaded.1Collect the machine's software and patch level
Runs as a normal user, needs no elevation, and changes nothing. It reads the uninstall registry keys
and the OS build - deliberately not Win32_Product, which reconfigures
every MSI it touches.
Paste this into PowerShell. It works from any directory:
irm https://getrff.com/vulnscan/Get-RffVulnScan.ps1 -OutFile $env:TEMP\Get-RffVulnScan.ps1
& $env:TEMP\Get-RffVulnScan.ps1
The absolute path matters: a PowerShell window opened from the Start menu often starts in
C:\WINDOWS\system32, where a normal user cannot write - which looks like the tool
demanding admin when it does not. The script itself is code-signed by Vitko Software, LLC, so it
runs under the default execution policy without a bypass.
The same script can do the whole job on its own if the machine has internet: it will download the index, match locally, and write an HTML report. This page exists for the machines that do not - which, for vulnerability scanning, is most of the interesting ones.
2Drop the file here
What this is, and what it is not
This matches the versions you have installed against published CVE version ranges. That is how most vulnerability scanners work, and it shares their limitation: it cannot tell whether a vendor backported a fix into the version you are running, so a patched build can still be reported. It also does not look inside binaries for embedded libraries.
The index covers roughly the top 500 Windows applications by published CVE count, plus Windows itself. The report always shows how many of your installed applications it recognised, so a zero reading is never ambiguous.
The index is rebuilt nightly. Last updated .
One machine is a useful afternoon. A fleet is a different problem.
RFF checks every endpoint continuously, tells you which are exposed, and can patch them and verify the fix landed.
Start free for 100 endpointsQuestions
How do I find out what is vulnerable on a Windows machine?
Run the collector script from PowerShell and drop the file it writes on this page. It reads the installed-software list and the OS patch level, matches them against a published vulnerability index, and lists the CVEs affecting the versions you actually have, with severity and CISA KEV flags.
Is my software inventory uploaded anywhere?
No. The index downloads to your browser and the matching runs there. A full list of what you run and which versions is real disclosure, so none of it reaches us. The collector is a readable script you can check before you run it.
Does it need administrator rights?
No. The collector reads the uninstall registry keys and the OS build number, all of which a normal user can read. Per-user installs under HKCU are only visible for the account that runs it, so running as the signed-in user usually sees more than running as SYSTEM.
Why does it not use Get-HotFix to check Windows patches?
Because Get-HotFix is unreliable and slow. On a fully patched Windows 11 machine it took 2.2 seconds and returned four rows, because modern cumulative updates do not register there consistently. The collector reads the Update Build Revision instead, which is one registry value and is the authoritative patch level.
Will it find everything?
No. The index covers roughly the top 500 Windows applications by published CVE count, plus Windows itself. The full NVD catalogue is far too big to hand a browser, and most of it is server and appliance software you will not find on a workstation. The report shows how many of your applications it recognised and how many it did not, so you can see what was actually checked.
Does it fix anything?
No. It only reports. Nothing on the machine is changed by the collector or by this page.