> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# infraudit vulnerability — vulnerability scan commands

> infraudit vulnerability scan, list, get — run CVE scans and filter findings. Key flags: --severity critical|high|medium|low, --status open|fixed, --resource.

The `vulnerability` command group (alias: `vuln`) manages vulnerability scanning and CVE findings. InfraAudit uses Trivy and the NVD database to identify vulnerabilities in your cloud resources.

## `vulnerability scan`

Run a vulnerability scan against all resources, or target a specific resource.

**Synopsis:**

```bash theme={null}
infraudit vulnerability scan [flags]
infraudit vuln scan [flags]
```

| Flag         | Description                                             |
| ------------ | ------------------------------------------------------- |
| `--provider` | Limit the scan to resources from a specific provider ID |
| `--resource` | Scan a single resource by ID                            |

Examples:

```bash theme={null}
# Scan all resources
infraudit vulnerability scan

# Scan a specific resource
infraudit vuln scan --resource 42
```

## `vulnerability list`

List vulnerability findings with optional filters.

**Synopsis:**

```bash theme={null}
infraudit vulnerability list [flags]
infraudit vuln list [flags]
```

| Flag         | Values                              | Description                  |
| ------------ | ----------------------------------- | ---------------------------- |
| `--severity` | `critical`, `high`, `medium`, `low` | Filter by CVSS severity      |
| `--status`   | `open`, `fixed`, `ignored`          | Filter by remediation status |
| `--provider` | provider ID                         | Filter by provider           |

Examples:

```bash theme={null}
# List all findings
infraudit vulnerability list

# Show only critical open findings
infraudit vuln list --severity critical --status open

# Count critical vulnerabilities for CI gating
infraudit vuln list --severity critical -o json | jq 'length'
```

## `vulnerability get`

Show full details for a single CVE finding, including the CVE identifier, description, CVSS score, and affected resource:

**Synopsis:**

```bash theme={null}
infraudit vulnerability get <finding-id>
infraudit vuln get <finding-id>
```

Example:

```bash theme={null}
infraudit vuln get 7
```

## `vulnerability summary`

Show an aggregate count of open findings grouped by severity:

```bash theme={null}
infraudit vulnerability summary
```

## `vulnerability top`

Show the highest-severity open vulnerability findings across all resources:

```bash theme={null}
infraudit vuln top
```

<Tip>
  To generate an AI-powered fix suggestion for a vulnerability, use [`infraudit remediation suggest-vuln <id>`](/cli/commands/remediation).
</Tip>