Cve Intel

CVE Intel

Know which vulnerabilities matter, and what to do about them.
A private desktop app for vulnerability triage and scanning, written in native Rust, with a CLI, REST API and MCP server for developers and AI agents.
41 MCP tools, 41 data sources, SBOMs in and out, on-device AI.

What it is · Getting started · Features · Install · Local AI · Data sources · Developer notes · Citing

_{Sped-up demo on macOS (1080p video): the threat landscape, triage and recording a decision, the decision ledger, a scan with attack chains and an SBOM, and the watchlist.}

What is CVE Intel?

Every known software vulnerability gets a public ID, such as CVE-2024-3400. For each one, security, IT and development teams face the same question: does this affect us, and do we fix it now or can it wait? Answering it usually means checking NVD, CISA, FIRST, GitHub and vendor advisories by hand, one browser tab at a time.

Why it matters now

CVE publication keeps rising (48,185 in 2025, 20.6% more than 2024, and over 86,000 by 27 October 2026), and in April 2026 NIST said the National Vulnerability Database cannot keep up, so it will enrich CVEs in CISA's Known Exploited Vulnerabilities (KEV) catalog, federal-use software and critical software first, and move its unenriched backlog from before 1 March 2026 to "Not Scheduled". Meanwhile, Mandiant's M-Trends 2026 estimates the mean time to exploit at −7 days, so exploitation routinely begins before a patch is released, and exploits were the most common initial infection vector for the sixth year running (32% of intrusions).

What it does

Give CVE Intel a CVE ID, a project folder, a lockfile or SBOM, a container image, the software on this computer, your own domains, or a suspicious IP address, file hash or domain. It queries up to 41 public sources, including CISA KEV, FIRST's EPSS and ENISA's EU Vulnerability Database alongside NVD, and returns what the vulnerability is, a risk score from 0 to 100, whether attackers are already using it, the evidence behind each signal and what to do next. It also shows what changed this week across those sources, and watches the vendors, products and packages you run.

• 41 data sources for vulnerability, exploit, network and threat intelligence, listed under Data sources. Many need no API key.
• 41 MCP tools for AI agents and coding assistants. The same program is also a command line and a REST API (see Developer notes).
• SBOMs in and out. It reads CycloneDX and SPDX SBOMs along with lockfiles, and Save SBOM (or scan deps . --format cyclonedx) writes any scan as a CycloneDX 1.5 SBOM with the findings, their risk signals and your recorded decisions.
• Local. There is no CVE Intel account or server. Lookups go straight from your computer to the public sources, and the AI assistant runs on a local model unless you choose a remote provider.

It is for security analysts, IT and operations teams, developers checking their dependencies, and anyone learning vulnerability management.

What it helps you do

• Decide whether to patch now. Enter a CVE ID and get a risk score from 0 to 100, a plain recommendation and how urgent it is, with the evidence behind it.
• Put a list of vulnerabilities in order. Paste up to 10 CVE IDs from a scanner report and get the order to patch them in.
• Check your project's dependencies. Drop a project folder on the window, or paste a lockfile or SBOM. You see which packages have known vulnerabilities, ranked by how likely they are to hurt you (Log4Shell first, not just the highest CVSS), and which version fixes them. Scan again later to see what is new, fixed or riskier since last time, or save the scan as a CycloneDX SBOM with the findings in it.
• Check what you run and ship. Scan the apps and operating system on this computer, or a container image you build (no Docker needed). Or see what public sources already know about your own domains and servers, without CVE Intel ever connecting to them.
• See what affects the products you run. List the known vulnerabilities for a product and version, such as Apache Tomcat 9.0.80, with actively exploited ones first.
• See what changed this week. Open Landscape for new CISA KEV entries, CVEs ENISA marks exploited that KEV does not list yet, rising EPSS scores, new Metasploit modules and PoCs, new critical CVEs, Project Zero's in-the-wild zero-days and the latest CISA advisories. CVEs that several sources agree on are listed first.
• Watch the products you run. Add a vendor, product, package or CVE to the local watchlist. Each refresh records what changed: new CVEs, KEV listings, EPSS jumps, new exploits, CVSS revisions and newly available fixes.
• Remember what you decided, and hear when the reasons change. Record a decision on a CVE (patch now, defer until a date, accept the risk, not affected, mitigated) with the assumptions it rests on. Every refresh re-checks them: a deferral turns stale the day the CVE enters CISA KEV or an exploit appears, and the ledger tells you how your past calls held up.
• Keep an eye on what attackers are exploiting. Filter CISA's catalog of actively exploited vulnerabilities by vendor, product, ransomware use or date.
• Investigate something suspicious. Check an IP address from your logs, a file hash your antivirus flagged, or an unfamiliar domain or URL against threat-intelligence sources.
• Ask questions in plain English. "Should we patch CVE-2024-3400 this weekend?" The AI assistant looks up the facts first, then explains them, and shows which sources it used.
• Give AI coding assistants the same knowledge. Claude Code, Cursor, VS Code and other tools can use CVE Intel while they work, through MCP.

Terms you'll see

The risk score combines these signals: severity (CVSS), the chance of exploitation (EPSS), confirmed exploitation (CISA KEV) and public exploit code. Anything on CISA KEV is always CRITICAL. See Risk score for the formula.

CVE Intel helps you decide what to patch. It does not probe, port-scan or attack anything, and it does not apply fixes. Scans read what is already on your machine (dependency files, the software installed on this computer, a container image you choose) and send only package and product names and versions to OSV.dev and NVD. The exposure check is passive: it asks public sources (Shodan, certificate transparency logs) what they already know about domains and addresses you own, and sends nothing to them. Results are only as current as the public sources.

Getting started

You don't need an account or any API keys to start. Most people are looking at their first result within a couple of minutes: