Glossary
nmap -sV — service and version detection. It asks each open port what is behind it, which is what makes CVE matching possible.
vulners — an nmap script that matches detected service versions against a CVE database.
nuclei — a template driven vulnerability scanner. Each template is a specific check, such as an exposed .env file or a known default login.
nuclei-templates — the public community template set nuclei runs. qsa.sh uses a curated high signal subset on Free and Full Pro, and the full set on Deep.
KEV — the Known Exploited Vulnerabilities catalogue. A CVE on this list is being exploited in the wild, which makes it a higher priority than severity score alone suggests.
CVE — a public identifier for a specific known vulnerability in a specific software version.
CGNAT — carrier grade NAT, where many customers share one public IP. qsa.sh refuses these because a scan would reach hosts that are not yours.
External scan — a scan run from outside your network, with no credentials and no agent, showing what an attacker can reach.
Exposure — a file or endpoint reachable that should not be, such as .git or .env.
TLS posture — the state of your certificate and cipher configuration as seen from outside.