cve-intel
A local security tool that combines public sources to assess CVE risk and record response decisions.
What does it do?
Enter a CVE ID, project folder, lockfile, SBOM, or container image to query public sources and see a vulnerability description, a 0~100 risk score, whether it is being exploited, and the supporting evidence. You can record decisions such as patch now, defer, or accept the risk, and select their assumptions. When you later refresh the watchlist, decisions are flagged for review if exploitation information or a fixed version invalidates an assumption. Decision records can be exported as OpenVEX or CycloneDX VEX, and no account or API key is needed to get started.
Key features
- Analyze CVE IDs, project files, SBOMs, container images, or installed software.
- Combine signals from public sources into a 0~100 risk score with supporting evidence.
- Monitor changes to vendors, products, packages, and CVEs.
- Record response decisions and their assumptions, and flag them for review when new evidence appears.
- Export decision records as OpenVEX or CycloneDX VEX.
- Get started without an account or API key.