cvescout 0.1.1

Changed: what counts as a PoC

• PoC now means a public PoC repository on GitHub, from nomi-sec/PoC-in-GitHub. The repositories are listed under each CVE and as github_pocs in --json and in the MCP/agent tools.
• References NVD tagged "Exploit", CISA SSVC poc and CVSS v4 E:P no longer count: for curl, for example, they rest on the HackerOne report with reproduction steps, not on exploit code. EXPLOITED (KEV, SSVC/CVSS "active") is unchanged.
• This applies to --poc, --enrich, --sort risk, watch and the MCP tools, so risk scores of CVEs that only had such references go down (curl: from high to medium/low).
• The list of CVEs with a PoC is cached for 6 hours in ~/.cache/cvescout/ (2–3 GitHub API requests). Without GITHUB_TOKEN GitHub allows 60 requests / h, shared with --cvelist.
• PoC repositories are unverified third-party code and some are malware: read them, don't run them.

New

• feed --cpe curl: a bare product name is looked up and the best CPE match used; the choice and the alternatives are printed.
• --full prints whole descriptions; by default they fit the terminal width and end with …. Piped output is not cut.
• Table column headers; a note when filters drop every result.

Help

• Examples for every command, the most used feed options in cvescout --help, a description for every argument.
• cvescout alone prints the help; a typo ends with see: cvescout feed --help.
• Codex is mentioned alongside Claude Code; ask points Codex / Claude Code users to mcp.
• README: activating the venv, running without activate, Polish README in sync.

Fixes

• Duplicate URLs removed from exploit_refs.
• --ghsa --sort risk reported the wrong number of advisories shown.

Upgrade: git pull (the editable install picks the changes up; run pip install -e . again if you installed without -e).

cvescout 0.1.0

First public release.

cvescout finds the latest CVEs from live sources instead of a language model's memory, ranks them by patch priority and can alert you about new CVEs in your products.

Highlights

• cvescout feed: recent CVEs from NVD, the CVE List (CVEProject/cvelistV5, about an hour ahead of NVD, no rate limit), GitHub Advisory Database and CISA KEV, with filters for RCE, CVSS, public exploits, products (CPE), keywords and reference links.
• Risk score (--sort risk): critical / high / medium / low from exploitation (KEV, SSVC, PoC), EPSS, CVSS and likely RCE, with the factors behind each rating.
• --url finds CVEs filed under libraries a product bundles, through the product's advisory page (e.g. a Brotli CVE in Node.js).
• cvescout watch: opt-in alerts per product with SQLite state, re-alerts when a CVE's priority rises, optional Slack/Discord/JSON webhook. Nothing runs until you schedule it.
• cvescout mcp: read-only MCP server for Claude Code, Claude Desktop or your own agent; cvescout ask: a Claude agent that must source every CVE from live data.

Tested on Linux, macOS and Windows with Python 3.11 and 3.14. See the README to get started.