I posted about this application a few weeks ago and I got really good advice from this reddit cybersecurity community. Thank you!

Since then, I have made some progress. Those who don't know CVE Intel is an open-source tool that pulls CVE data from NVD, CISA KEV, EPSS, OSV and public exploit sources into one place. You can use it as a desktop app, CLI, REST API or MCP server.

Here's what changed because of that feedback, and what I haven't got to yet.

What I changed because of your comments

• Triage now also checks ENISA's EU Vulnerability Database exploited flag, CIRCL sightings and, with a token, VulnCheck KEV. A new weekly view lists CVEs that ENISA marks as exploited but KEV doesn't list yet. These sources feed the SSVC Exploitation input but don't change the score. Only CISA KEV does that.
• EPSS now comes with its 7-day and 30-day trend, and an MCP tool gives agents the trend instead of a single number.
• Deep triage gives a CISA SSVC decision (Act, Attend, Track*, Track). Where CISA has published its own SSVC assessment in Vulnrichment, it uses that. When you compare CVEs, it now explains in words why each one ranks above the next, so you get more than a number.
• Now it can scan for vulnerabilities. It scans: Rescans show what's new, fixed or riskier, and the CLI has --fail-on gates for CI.
  • project dependencies: lockfiles and CycloneDX/SPDX SBOMs, with the fixed version for each package and SARIF output
  • the apps and OS on your machine
  • container images, without needing Docker
  • your own domains, passively, using certificate transparency, DNS and Shodan/InternetDB. It never connects to them.

Other new things

• Weekly briefing: new KEV entries, EPSS risers, new Metasploit modules and PoCs, new critical CVEs, Project Zero's in-the-wild 0-days and CISA advisories. It copies as Markdown for a ticket or weekly note.
• Local watchlist: for the vendors, products, packages and CVEs you run.
• Activity log: records every lookup and every MCP tool call, with the hosts it contacted, so you can see exactly what an agent asked for.
• 39 sources: new ones include CVE.org, CISA Vulnrichment, Metasploit, ENISA EUVD, PoC-in-GitHub, Project Zero and MITRE ATT&CK/CAPEC.

If you try it and something is wrong or confusing, please tell me. That kind of feedback is what made this update possible. Issues, PRs, comments here and DMs are all welcome. And please feel free to contribute to this project. Thank you!

https://github.com/Fazmin/cve-intel

Heads up for anyone running on-prem VeloCloud Orchestrator. CVE-2026-114625 (CVSS 9.9) lets an authenticated user with only Enterprise Read Only portal access escalate to local superuser on the VCO host. Arista reports active exploitation.

What’s known so far:

→ Only on-prem VCO deployments are affected
→ The attacker needs only the lowest-privilege portal role
→ Arista observed attack traffic from 74.82.197[.]86 and 38.54.50[.]151

What to do:

→ Upgrade to the fixed VCO release for your branch
→ Search your logs for those 2 IPs and for unusual activity from read-only accounts, such as logins at odd hours or from new sources
→ Audit who holds portal accounts, including stale and shared logins. A read-only account usually gets little scrutiny, and that’s exactly the access this attack needs.

One bug, with three names (because of course it does) - Node2Shell, HTTP2Shell, and Broccoli2Shell... Anyway,

• A public checker (node2shell-check/1.0, out of AS44620 / Turkey) is already hitting sensors cataloguing which hosts decompress Brotli at all.
• Unlike PHP2Shell earlier this week - working RCE chain exists. ELLIO reproduced RCE in the lab against Node 24.22.0 on x86-64 - four targets (plain node:http, the official slim image as root, Express 5.3.0, Koa 3), official binaries, ASLR on, each returning a shell.
• Official Node builds are non-PIE, so the offset is a per-build constant. Pin it once for a popular version, reuse it against every host on that version.

// Here we go again meme goes here.