## https://sploitus.com/exploit?id=33F0E442-853F-5822-8EFC-64D4284CBB14
# C V E y e
**Zero-dependency CLI for CVE details & exploit availability — without API keys**
NVD · OSV.dev · MITRE · CISA KEV · FIRST EPSS · ExploitDB · GitHub
*ProjectDiscovery-style output, CVSS v4.0 scoring, concurrent batch mode*
[Quick Start](#-quick-start) ·
[Commands](#-commands) ·
[Configuration](#%EF%B8%8F-configuration) ·
[Contributing](#-contributing)
---
> [!WARNING]
> CVEye is for **defensive security research** only. You are responsible for
> your actions. Always obtain proper authorization before testing any system.
## 📖 Table of Contents
- [Why CVEye?](#-why-cveye)
- [Quick Start](#-quick-start)
- [Commands](#-commands)
- [Demo](#-demo)
- [Data Sources](#-data-sources)
- [Output Style](#-output-style)
- [Exploit Signal Model](#-exploit-signal-model)
- [Configuration](#%EF%B8%8F-configuration)
- [Caching](#%EF%B8%8F-caching)
- [Tool Interop](#-tool-interop)
- [Exit Codes](#-exit-codes)
- [Project Structure](#-project-structure)
- [Development](#-development)
- [Roadmap](#-roadmap)
- [FAQ](#-faq)
- [Contributing](#-contributing)
- [Acknowledgments](#-acknowledgments)
- [License](#-license)
## 🤔 Why CVEye?
Most CVE tooling forces you through API-key signup walls, pip dependency
hell, or rate-limit roulette. **CVEye does one thing well**: answer *"what is
this CVE, and can I exploit it?"* — instantly, from public sources, with
clean ProjectDiscovery-style output that pipes beautifully.
```text
✅ Zero dependencies Python stdlib only — runs anywhere, even Termux
✅ Zero API keys NVD, OSV, MITRE, KEV, EPSS, ExploitDB — all public
✅ CVSS v4.0 scoring Official FIRST MacroVector algorithm embedded
✅ Honest signals Confirmed exploits separated from weak "leads"
✅ Fast Disk cache + concurrent batch mode
✅ PD-native Single-dash flags, stderr/stdout discipline
```
## 🚀 Quick Start
```bash
# Run directly from a checkout
git clone https://github.com/PwnedBytes0x1/cveye.git
cd cveye
python3 main.py -h
# Or install as a proper console script
pip install .
cveye latest
```
Requirements
| Requirement | Notes |
|-------------|-------|
| Python **3.7+** | stdlib only — no `pip install` needed |
| `git` | optional, only for `-clone-pocs` |
| `GITHUB_TOKEN` | optional env/config key; raises GitHub search limits |
## ⌨️ Commands
| Command | Purpose |
|---------|---------|
| [`latest`](#latest--newest-published-cves) | Newest published CVEs from NVD |
| [`search`](#search--cve-details) | Full details for one CVE |
| [`check`](#check--exploit-availability) | Exploit availability check |
| [`scan`](#scan--details--exploits) | Details + exploit check combined |
| [`affected`](#affected--am-i-affected) | Is my product (CPE) affected? |
| [`watch`](#watch--new-exploited-vulns) | Diff CISA KEV against last run |
| [`report`](#report--htmlmarkdown-reports) | Render JSON as HTML / Markdown |
| [`completions`](#completions--shell-completions) | bash / zsh / fish scripts |
| `version` | Version information |
Flags follow the **ProjectDiscovery convention** — single-dash long options,
exactly like `nuclei`, `httpx` and `subfinder`.
### Global Flags
| Flag | Description |
|------|-------------|
| `-h, -help` | Show help and exit |
| `-V, -version` | Show version and exit |
| `-s, -silent` | Suppress info/warning messages (**errors still shown**) |
| `-no-color` | Disable ANSI colors |
| `-o, -output FILE` | Write stdout results to file |
| `-j, -json` | Machine-readable JSON output |
| `-no-cache` | Bypass the local response cache |
---
### `latest` — newest published CVEs
```bash
cveye latest # newest 10
cveye latest -l 20 -e # 20 entries + exploit checks
cveye latest -l 50 -c # compact, one line per CVE
cveye latest -json # machine-readable
```
True newest-first ordering via NVD tail pagination. Fallback chain:
publish-date query → recently-modified query → CISA KEV catalog.
### `search` — CVE details
```bash
cveye search CVE-2021-44228
cveye search CVE-2021-44228 -f # all references
```
Severity badge, CVSS v3/v4 score, **EPSS probability**, aliases, description,
affected products and references. IDs are validated client-side — garbage
input fails instantly, offline.
### `check` — exploit availability
```bash
cveye check CVE-2021-44228
cveye check CVE-2021-44228 -D -clone-pocs # download + clone PoCs
printf 'CVE-2021-44228\nCVE-2024-3400\n' | cveye check - -c 10
```
### `scan` — details + exploits
```bash
cveye scan CVE-2021-44228
cveye scan CVE-2021-44228 -json
```
### `affected` — am I affected?
```bash
cveye affected CVE-2021-44228 -cpe apache:log4j
cveye affected CVE-2024-3400 \
-cpe "cpe:2.3:a:paloaltonetworks:pan-os:10.2:*:*:*:*:*:*:*"
```
Accepts full CPE 2.3 URIs, legacy 2.2 notation, or `vendor:product`
shorthand. Wildcard-aware matching against NVD configuration data.
### `watch` — new exploited vulns
```bash
cveye watch # diff vs last run (state file)
cveye watch -since 168 # 7-day look-back window
cveye watch -json # machine-readable
```
First run seeds the baseline; every later run prints only *new* KEV
additions — ransomware usage flagged in red.
### `report` — HTML/Markdown reports
```bash
cveye scan CVE-2021-44228 -json | cveye report -o report.html
cveye latest -l 50 -json -o out.json && cveye report -i out.json -format md
```
Accepts any CVEye JSON payload (`scan`, `check`, `latest`, `search`).
Self-contained dark-themed HTML; clean Markdown tables.
### `completions` — shell completions
```bash
cveye completions -shell bash >> ~/.bashrc # or zsh / fish
```
## 🎬 Demo
```text
$ cveye scan CVE-2021-44228
CVE Details: CVE-2021-44228
CVE-2021-44228
[CRITICAL] Severity: CRITICAL CVSS: 10.0
Source: OSV (aka GHSA-jfh8-c2jp-5v3q)
Published: 2021-12-10
Modified: 2026-08-13 04:01
EPSS: 100.0% exploitation probability (percentile 100.0)
Exploit Analysis
Strong signals found for CVE-2021-44228:
[!] CISA Known Exploited Vulnerability (exploited in the wild)
Name: Apache Log4j2 Remote Code Execution Vulnerability
Date Added: 2021-12-10
Known Ransomware Use: Known
[+] ExploitDB exploits found:
- [EDB-50592] Apache Log4j 2 - Remote Code Execution (RCE)
https://www.exploit-db.com/exploits/50592
[+] GitHub PoC repositories found:
- fullhunt/log4j-scan (3421 stars)
https://github.com/fullhunt/log4j-scan
[+] SUMMARY: Exploits found for CVE-2021-44228
```
## 📡 Data Sources
| Source | What it provides | Key needed? |
|--------|------------------|-------------|
| [NVD 2.0 API](https://nvd.nist.gov/developers) | CVE details, CPE configs, CVSS | ❌ (5 req/30s) |
| [OSV.dev](https://osv.dev) | Rich vulnerability records | ❌ |
| [MITRE CVE Services](https://cveawg.mitre.org) | Authoritative CVE records | ❌ |
| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Exploited-in-the-wild list | ❌ |
| [FIRST EPSS](https://www.first.org/epss/) | Exploitation probability | ❌ |
| [ExploitDB mirror](https://gitlab.com/exploit-database/exploitdb) | Full exploits CSV index | ❌ |
| [GitHub Search](https://docs.github.com/rest/search) | PoC repositories | ❌ *(token optional)* |
## 🎨 Output Style
**Status → stderr. Data → stdout.** The banner, `[INF]/[WRN]/[ERR]/[+]`
tags and progress never pollute pipes or `-output` files. Color support is
evaluated per stream, so redirected output stays clean while your terminal
stays pretty.
Severity badges: `[CRITICAL]` red bg · `[HIGH]` orange · `[MEDIUM]` yellow ·
`[LOW]` green · `[UNKNOWN]` dim.
The banner shows on every invocation (`version`, bare `cveye`, `-h`) —
matching PD tool behavior.
## 🔍 Exploit Signal Model
CVEye refuses to cry wolf:
| Signal class | Examples | Effect |
|--------------|----------|--------|
| ✅ **Confirmed** | CISA KEV listing, ExploitDB entry, relevant GitHub PoC repo (CVE ID in name/description), PacketStorm / Metasploit / VulnCheck | Drives `has_exploit`, green summary |
| 💡 **Reference leads** | Pages merely mentioning *poc/exploit* keywords | Dim, labeled *"unconfirmed"* — never triggers a verdict |
## ⚙️ Configuration
`~/.config/cveye/config.json` (Windows: `%APPDATA%\CVEye\config.json`).
Precedence: **CLI flag > config file > environment > default**.
```json
{
"limit": 10,
"download_dir": "exploits",
"concurrency": 5,
"silent": false,
"no_color": false,
"no_cache": false,
"github_token": ""
}
```
## ♻️ Caching
| Data | TTL | Storage |
|------|-----|---------|
| CVE details | 1 hour | `~/.cache/cveye/cache.json` |
| EPSS scores | 24 hours | same |
| CISA KEV index | 30 minutes | `~/.cache/cveye/big-cache.json` |
| ExploitDB CSV index | 24 hours | same |
Bypass everything with `-no-cache` or `CVEYE_NO_CACHE=1`. Delete the files
to reset.
## 🔗 Tool Interop
nuclei/httpx JSON lines are auto-detected on stdin — CVEs are extracted per
line, deduplicated, and processed:
```bash
cat nuclei-results.jsonl | cveye check - -silent
printf 'CVE-2021-44228\nCVE-2024-3400\n' | cveye scan - -c 20 -json
```
Failed lookups never vanish silently:
```bash
$ cat cves.txt | cveye scan - -json | jq '.[] | select(.error)'
{"cve_id": "CVE-2099-00001", "error": "lookup failed"}
```
## 🚦 Exit Codes
| Code | Meaning |
|------|---------|
| `0` | Success |
| `1` | Operational failure (not found, fetch failed, invalid ID) |
| `2` | Usage error (bad arguments, unwritable output) |
## 🏗️ Project Structure
```text
├── main.py launcher shim (source checkouts)
├── pyproject.toml packaging (console script: cveye)
├── cveye/
│ ├── cli.py argparse CLI, commands, batch engine
│ ├── config.py URLs, constants, user-config loading
│ ├── colors.py ANSI colors, PD tags/banner (stderr)
│ ├── utils.py HTTP client, validation, CVSS v3, CPE
│ ├── cvss4.py CVSS v4.0 scorer (official lookup embedded)
│ ├── cache.py persistent TTL caches (small + bulk)
│ ├── sources.py NVD / OSV / MITRE / KEV / EPSS fetchers
│ ├── exploits.py exploit checker, EDB index, downloader
│ └── report.py HTML/Markdown report rendering
└── tests/ unittest suite (mocked, zero network)
```
## 🧪 Development
```bash
python3 -m unittest discover -s tests # 41 tests, fully mocked
python3 main.py -h # run from source
```
Design notes:
- **CVSS v3.x** requires every mandatory metric — partial vectors are never
guessed, so computed scores are never silently inflated.
- **CVSS v4.0** embeds FIRST's official MacroVector lookup + interpolation;
validated against the **31,694-vector reference corpus (100% pass)**.
- **HTTP**: permanent 4xx errors are never retried; 429/5xx/network retry
with backoff. Unknown CVEs fail fast instead of stalling.
- **Downloads**: filenames resolved from Content-Disposition / URL / content
sniffing; oversized payloads refused; repo names sanitized before clone.
## 🗺️ Roadmap
- [ ] Nuclei template suggestions per CVE
- [ ] SARIF output for CI pipelines
- [ ] `diff` command between two JSON result sets
- [ ] Optional SQLite cache backend for very large batches
## ❓ FAQ
Does this need API keys?
No. Every data source used by default is public. A GitHub token is optional
and only raises search rate limits.
Why single-dash flags?
It matches ProjectDiscovery tools (Go's pflag convention). --json
is rejected exactly like nuclei --json would be.
Is this a scanner?
No — CVEye performs OSINT about published vulnerabilities. It never
touches target systems.
Windows support?
Yes. ANSI colors are enabled best-effort on legacy consoles; everything else
is pure stdlib.
## 🤝 Contributing
PRs welcome! Please keep the zero-runtime-dependency promise: stdlib only,
Python 3.7+ compatible, and add tests for new logic.
```bash
git clone https://github.com/PwnedBytes0x1/cveye.git
cd cveye
python3 -m unittest discover -s tests
```
## 🙏 Acknowledgments
- [FIRST](https://www.first.org/cvss/) — CVSS v4.0 specification & reference calculator (BSD-2-Clause, ported in `cvss4.py`)
- [ProjectDiscovery](https://github.com/projectdiscovery) — output & flag conventions that inspired this UX
- [NVD](https://nvd.nist.gov), [OSV.dev](https://osv.dev), [MITRE](https://cve.org), [CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [FIRST EPSS](https://www.first.org/epss/), [ExploitDB](https://www.exploit-db.com) — the open data making this possible
## 📄 License
[MIT](LICENSE) © PwnedBytes0x1
---
**If CVEye saved you time, consider leaving a ⭐**
Made with ☕ and Python stdlib by [PwnedBytes0x1](https://github.com/PwnedBytes0x1)