CVE Security Advisory Triage
Pricing
Pay per event
Rank CVEs and package vulnerabilities by priority using NVD, CISA KEV, EPSS and OSV, with a plain verdict and the reasons behind it.
Pricing
Pay per event
Rating
0.0
(0)
Developer
Chris O'Byrne
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
a day ago
Last modified
Categories
Share
cve-triage looks up CVE ids (or a keyword) and returns scores, KEV and EPSS status, affected packages and a priority verdict. watchlist-scan checks up to 50 packages or CPE strings and returns known vulnerabilities ranked by priority.
CVE ids such as CVE-2021-44228. Up to 100 per run. Each CVE is looked up in NVD one at a time, so a run takes about 7 seconds per CVE without an NVD API key.
Optional. Searches NVD descriptions, for example "openssl heap overflow". Results are ranked by priority after enrichment. Used together with the CVE ids above, or on its own.
How many CVEs to take from a keyword search (1 to 50). Each CVE returned is billed as one cve-triage event.
Match the keyword as an exact phrase instead of all words anywhere in the description.
List of objects with name, ecosystem and version, for example {"name": "lodash", "ecosystem": "npm", "version": "4.17.15"}. Ecosystems follow OSV names: npm, PyPI, Maven, Go, crates.io, NuGet, RubyGems, Packagist, Hex, Pub and more. Up to 50 packages plus CPE strings per scan.
Optional complete CPE 2.3 names, for example cpe:2.3:a:apache:log4j:2.14.1:::::::*. Each one is one NVD request (about 7 seconds without an API key). Up to 20, and the combined total with packages must be 50 or fewer.
Caps how many OSV advisories are loaded for each package (1 to 500). Advisories are not ranked before they are loaded, so keep this high enough to cover old versions.
Hide findings below this priority. A scan is billed once if at least one finding is returned.
Optional. Your own free NVD API key raises the NVD limit from 5 to 50 requests per 30 seconds, which makes cve-triage runs faster. Without a key the Actor keeps to the unauthenticated limit. Request a key at nvd.nist.gov/developers/request-an-api-key.
