feat: redesign vulnerability detail page with merged info and source tabs - #40
Merged
Conversation
- Add BaseSeverity() function to cvss package that returns severity labels (NONE/LOW/MEDIUM/HIGH/CRITICAL) based on score and CVSS version thresholds - Add comprehensive table-driven tests for BaseSeverity covering v2, v3.x, v4.0 boundary values and empty vector fallback - Extend model.Severity struct with computed BaseScore and BaseSeverity fields - Compute base_score/base_severity for OSV Severity entries in buildBaseDetail - Fill missing base_score/base_severity for MITRE metrics from vector_string Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
…source tabs - Add base_score and base_severity optional fields to Severity interface - Rewrite component with top section (merged CVSS scores, risk indicators, affected packages) and bottom section (tabbed OSV/NVD/MITRE views) - Add computed signals: highestCvssScore, allCvssScores, availableTabs - Implement tab switching via activeTab signal with ARIA attributes - Extract template to separate HTML file for maintainability - Add i18n with @@ IDs for all new text (mergedScores, riskIndicators, tabOsv, tabNvd, tabMitre, highestScore, source) - Update tests for new tabbed layout including tab switching Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
Co-authored-by: kato83 <24907348+kato83@users.noreply.github.com>
- Rename CVSS Scores panel heading to 'Severity' (深刻度) to accommodate non-CVSS scoring systems (e.g., Drupal NISTIR 7864) - Display CVSS vector string under each score entry when available (OSV severity.score, NVD vector_string, MITRE vector_string) - Expand KEV section in Risk Indicators card to show full details: vulnerability_name, vendor/product, date_added, due_date, ransomware campaign use, and required_action - Update i18n translations accordingly
- Add 'EPSS', 'CISA KEV', 'LEV' source labels above each indicator in the Risk Indicators card for clarity - Show EPSS score_date below the percentile - Keep KEV indicator in Risk card as compact summary (In KEV + vendor) - Move KEV full detail (vulnerability_name, dates, ransomware, required_action) into a separate panel with grid layout - Update i18n translations
- Show severity_worst–severity_best range in header card (matching list view) - Merge score into severity badge: 'CRITICAL: 9.8' instead of separate elements - Add formatScoringVersion() to display human-readable versions: v31 → 'CVSS v3.1', v40 → 'CVSS v4.0', CVSS_V3 → 'CVSS v3.1', etc.
Grid items stretch to equal height (default), while inner content is vertically centered using flex-col + justify-center.
- OSV tab: display published, modified, and withdrawn dates - NVD tab: display published, last_modified, and vuln_status in grid - MITRE tab: reorganize to show published, updated, state, assigner in a consistent grid layout (state moved from badge to grid item) - Add i18n translations for new keys
Backend: - Add NVDConfigurationDetail and NVDCPEMatchDetail to model - Add fetchNVDConfigurations() to query nvd_configurations and nvd_cpe_matches tables and return CPE match criteria Frontend: - Add NVDConfigurationDetail/NVDCPEMatchDetail TypeScript interfaces - Display 'Affected Software (CPE)' section in NVD tab showing CPE criteria with version ranges - Add i18n translations
Instead of hiding the KEV indicator when a vulnerability is not in the CISA KEV catalog, display a greyed-out panel with 'KEV登録なし' text to make the absence of KEV listing explicit.
Backend:
- Add GET /api/v1/vulnerabilities/{id}/epss-history endpoint
- Add GetEPSSHistory() to store interface and PostgresStore
- Returns full EPSS score history ordered by date
Frontend:
- Add chart.js 4.5.1 dependency
- Create EpssChartComponent (standalone, line chart with area fill)
- Integrate into vulnerability detail page below Risk Indicators
- Chart displays when 2+ data points are available
- Auto-hides point markers when >60 data points for readability
Detect dark mode via document.documentElement.classList and apply lighter tick/grid colors for readability on dark backgrounds.
Backend: - Include raw_json from osv_entries, nvd_entries, mitre_entries in the vulnerability detail API response Frontend: - Add formatRawJson() helper (JSON.stringify with 2-space indent) - Add <details><summary>Raw JSON</summary> section at the bottom of each source tab (OSV, NVD, MITRE) - Styled with max-height scroll, monospace font, dark mode support
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created by @kiro-agent on behalf of @kato83 👻
Comment with /kiro fix to address specific feedback or /kiro all to address everything.
Learn about Kiro Web
Summary
Redesigns the vulnerability detail page to merge information from multiple sources (NVD, OSV, MITRE) at the top of the page and provide source-specific tabs at the bottom for detailed inspection.
Changes
Backend (Go)
cvss.BaseSeverity(score, vector)function that returns severity labels (CRITICAL/HIGH/MEDIUM/LOW/NONE) based on CVSS version-specific thresholdsmodel.Severitystruct withBaseScore *float64andBaseSeverity stringfieldsstore/detail.go: computes score/severity from vector strings for OSV severity entries and fills missing values for MITRE metrics using the existingcvss.BaseScore()functionBaseSeveritycovering all CVSS v2/v3.x/v4.0 boundary valuesFrontend (Angular)
i18n
Testing