## https://sploitus.com/exploit?id=0E210FE7-3F85-5D2A-B00D-874904272BDC
# PatchScope
Match an installed-software inventory against known CVEs and produce a
prioritized patch report. Known-exploited first, then by CVSS. The point is not
to list every vulnerability. The point is to answer one question. What do I patch
first.
## What it does
I run patch management as a system administrator. The hard part is never finding
vulnerabilities. It is deciding the order to fix them. PatchScope takes an
inventory of installed software, compares each version against the CVE feed, and
returns a ranked list.
- **Version-aware matching.** It compares installed versions against the affected
ranges from each CVE. It understands patch suffixes like `1.9.5p2` and trims
distribution tails like `1.9.5p2-1ubuntu1`, so `sudo 1.9.5p1` is flagged and
`sudo 1.9.5p2` is not.
- **Real prioritization.** CISA Known Exploited Vulnerabilities outrank
everything, then CVSS base score. A known-exploited 9.8 sorts above a
theoretical 10.0, because that is how triage actually works.
- **Name normalization.** "Apache Log4j", "log4j-core", and "log4j" all resolve
to one product, so matching is not defeated by naming.
- **Real data.** CVSS scores and descriptions come from the NVD feed.
Known-exploited flags come from the CISA KEV catalog. A bundled offline
snapshot lets the demo run anywhere in seconds. Online mode queries the live
NVD API and parses its native JSON with the same matcher.
## Quick start
Run the demo. It needs no network and no inventory of your own.
```
python -m patchscope.cli --demo
```
Write the HTML report.
```
python -m patchscope.cli --demo --out report.html
```
Scan your own inventory. A CSV or JSON with product, version, and an optional
host works.
```
python -m patchscope.cli --inventory inventory.csv --out report.html
```
Collect a Windows inventory first, read-only, then scan it.
```
powershell -File tools/collect_inventory.ps1 -OutFile inventory.csv
python -m patchscope.cli --inventory inventory.csv --out report.html
```
Query the live NVD feed instead of the bundled snapshot.
```
python -m patchscope.cli --inventory inventory.csv --online --api-key YOUR_KEY
```
## Inventory format
CSV with a header, or a JSON list. Column names are flexible. Product can be
`product`, `name`, or `software`. Version can be `version` or `ver`. Host is
optional.
```
host,product,version
web-app-01,Apache Log4j,2.14.1
db-01,OpenSSL,3.0.13
```
## Demo output
The bundled inventory is synthetic. The CVEs are real. On the demo fleet the
report finds 14 vulnerabilities across 23 packages, 9 of them known to be
exploited, and orders them so the known-exploited critical issues are at the top.
## Development
```
pip install -e .
python -m pytest -q
python -m ruff check .
```
No runtime dependencies. Python 3.9 and up.
## Scope
PatchScope is defensive. It reads an inventory and reports. It does not patch,
scan a network, or deploy agents. The bundled data is a curated snapshot for
demonstration. Live mode uses the authoritative NVD and CISA feeds.
## About
Projects in this portfolio are built through my automated development pipeline. I
design the roadmap, review the output, and operate the system that ships it.