Free, open-source sites and tools that take the CVE list apart and publish what they find, each rebuilt from public feeds by GitHub Actions.
RogoLabs is my personal open-source lab. Rogo is Latin for "I ask," which is most of the job: each site below asks one question about vulnerability data and answers it in public, with the code in this org. Jerry Gamblin, @jgamblin.
| Site | The question it answers | Code |
|---|---|---|
| CVE.ICU | What is in the CVE list right now? Rebuilt whenever a fresh NVD snapshot lands. | cve.icu |
| CVEForecast | How many CVEs are coming next, overall and per CNA? | CVEForecast |
| CVE Floodline | Is a jump in CVE volume rain or a flood? Uses EPSS and CISA KEV to tell them apart. | cvefloodline.org |
| PatchThis | What should you patch first? Built from CISA KEV, Metasploit and Nuclei coverage plus high EPSS scores. | patchthisapp |
| RBP Tracker | Which CVE IDs are cited in public advisories but still sit in Reserved? | RBP |
| Ghost CVEs | Which CVE IDs are already public in commits or advisories while CVE.org lists them as Reserved, or not at all? | GhostCVEs |
| CNA Scorecard | How completely does each CNA fill in its CVE records? | CNAScoreCard |
| CNAPulse | Which CNAs are publishing more, or less, than their own baseline? | CNAPulse |
| Consensus Engine | Where do NVD and the GitHub Advisory Database disagree on a CVSS score? | consensus-engine |
| CVETime | How much time passes between CVE publications, globally and per CNA? | CVETime |
| CVE Updates | How often do CVE records change after they are published? | CVE-Updates |
| SADP Tracker | How much are supplier CNAs enriching CVE records through the Supplier ADP program? | SADP-Tracker |
- VulnRadar: an hourly CVE watchlist on GitHub Actions. Put your vendors and products in
watchlist.yaml, and a match opens an issue with KEV and EPSS context. - quarry: a local-first vulnerability hunter for open-source repos on macOS, with sandboxed scanning and draft disclosure advisories.
- Splunk add-ons: CVE.icu for Splunk (the full CVE V5 corpus with EPSS, KEV, SSVC and CVSS, on Splunkbase), TA-cvelist and TA-epss.
- EPSS-History: an archive of the daily EPSS score files from FIRST.
Talk slides live on rogolabs.net. Data reviews and build logs live on jerrygamblin.com.
Every number on these sites comes from a public feed and a script you can read. If one looks wrong, open an issue on that repo and show me. I would rather be corrected than believed.