Vulnerability Tracking Guide

Find, prioritise, and fix vulnerabilities across Linux servers, containers, and home labs. This practical guide runs from inventory to verified patches, covering CVEs and scoring, distro security tooling, automatic patching, network and host scanning, container images, SBOMs, and continuous monitoring.

Track Every Vulnerability: CVEs, Scanners, SBOMs and Patching for Linux Servers, Containers and Home Labs takes you from the question "what am I actually running?" all the way to prioritised, verified fixes. Part of Dargslan's Security Series, it's a practical, end-to-end guide to vulnerability management built around a simple, repeatable loop: inventory, detect, prioritise, fix and verify.

Vulnerability management is one of those disciplines everyone knows they should do and few do well. New CVEs appear every day, scanners spit out hundreds of findings, and it's genuinely hard to tell what matters, what to fix first, and whether a fix actually worked. This guide cuts through that noise with a structured workflow you can apply whether you run a fleet of production servers, a stack of containers, or a home lab.

Two Detection Tracks, One Workflow

The book is organised around two complementary detection tracks that run through the whole guide. The host track covers operating systems, patching, network scanning, and continuous host auditing with Wazuh. The software track covers container images, software bills of materials (SBOMs), Dependency-Track, and your own application code and dependencies. Together they give you full coverage-from the OS up through the software you build and ship.

Foundations That Make the Rest Make Sense

You'll start by understanding what vulnerability management actually is, then get a clear grounding in CVEs, security advisories, and databases, and in scoring and prioritising findings so you can separate the urgent from the noise. A dedicated chapter on knowing what you run establishes the inventory foundation that everything else depends on-because you can't secure what you don't know you have.

Detect Across Every Layer

From there, the guide walks the full detection surface:

• Distribution security tooling and automatic patching to keep systems current
• Network vulnerability scanning to find exposed, exploitable services
• Host auditing and continuous detection with Wazuh
• Scanning container images for known vulnerabilities before and after deployment
• Software bills of materials (SBOMs) to know exactly what's inside your software
• Continuous monitoring with Dependency-Track
• Application dependencies and your own code, closing the loop on what you build
• Feeds, alerts, and early warning so new threats reach you fast

From Findings to Verified Fixes

Detection is only half the job. The guide dedicates real attention to what most tools leave you to figure out alone: triage-turning a pile of findings into actual decisions-followed by remediation and verification, so you can prove a fix genuinely closed the hole rather than hoping it did. Chapters on metrics and reporting, and on putting it all together, turn these pieces into a sustainable program you can measure and improve over time.

Practical for Real Environments

This isn't enterprise theory bolted onto tools you'll never run. The guidance is grounded in open-source tooling and scaled for Linux servers, containers, and home labs alike, so you can stand up a real vulnerability management workflow without an enterprise budget. The appendices provide reference material to support the workflow as you operate it day to day.

Who This Book Is For

Whether you're a system administrator responsible for patching, a DevOps or security engineer building detection into your pipelines, or a home lab enthusiast who wants to take security seriously, this guide meets you where you are and gives you a complete, repeatable process-from inventory to prioritised, verified fixes.

Why This Book

You can't patch everything, and you can't patch nothing. The real skill is knowing what you run, seeing what's vulnerable, deciding what matters, fixing it, and proving it's fixed. This guide gives you that skill as a working discipline, across both the host and software sides of your environment.