cvescout 0.1.1

Changed: what counts as a PoC

• PoC now means a public PoC repository on GitHub, from nomi-sec/PoC-in-GitHub. The repositories are listed under each CVE and as github_pocs in --json and in the MCP/agent tools.
• References NVD tagged "Exploit", CISA SSVC poc and CVSS v4 E:P no longer count: for curl, for example, they rest on the HackerOne report with reproduction steps, not on exploit code. EXPLOITED (KEV, SSVC/CVSS "active") is unchanged.
• This applies to --poc, --enrich, --sort risk, watch and the MCP tools, so risk scores of CVEs that only had such references go down (curl: from high to medium/low).
• The list of CVEs with a PoC is cached for 6 hours in ~/.cache/cvescout/ (2–3 GitHub API requests). Without GITHUB_TOKEN GitHub allows 60 requests / h, shared with --cvelist.
• PoC repositories are unverified third-party code and some are malware: read them, don't run them.

New

• feed --cpe curl: a bare product name is looked up and the best CPE match used; the choice and the alternatives are printed.
• --full prints whole descriptions; by default they fit the terminal width and end with …. Piped output is not cut.
• Table column headers; a note when filters drop every result.

Help

• Examples for every command, the most used feed options in cvescout --help, a description for every argument.
• cvescout alone prints the help; a typo ends with see: cvescout feed --help.
• Codex is mentioned alongside Claude Code; ask points Codex / Claude Code users to mcp.
• README: activating the venv, running without activate, Polish README in sync.

Fixes

• Duplicate URLs removed from exploit_refs.
• --ghsa --sort risk reported the wrong number of advisories shown.

Upgrade: git pull (the editable install picks the changes up; run pip install -e . again if you installed without -e).