For an all-around FREE vulnerability scanner, you just can't beat Nessus:
www.nessus.org
It runs in 2 parts, a client and a server. You need *nix of some sort to run the server, but there are even windows clients. It has a plugin based structure and comes with its own scripting language for creating custom plugins. It has all of nmap's functionality and much much more. Check it out.