Security Advisory Scout

By aleff-github

Overview

Investigate CVE, GHSA, and OSV security advisories using source evidence from NVD and OSV, FIRST EPSS exploitation probability, and CISA KEV known-exploitation information. Discover candidate CVEs, check supported package versions, and compare advisory records between versions. Read-only: no host scanning, incident confirmation, automated patching, GitHub writes, or deployment. Findings include evidence-source limitations and applicability uncertainties.

Tools

check_package_version

ChatGPT

Query OSV for one supplied package version, then enrich returned CVEs with EPSS and CISA KEV evidence. OSV may normalize or fuzzily match upstream version strings, so results are version-specific source evidence rather than an independent exact-version proof.

compare_package_versions

ChatGPT

Compare OSV advisory results for two supplied versions of the same supported package. Separates resolved, persisting, and introduced OSV records without treating the source's version matching as an independent exact-version guarantee.

search_advisories

ChatGPT

Search NVD by free-text product, vendor, or vulnerability terms. Results are discovery candidates only and do not prove version applicability.

triage_advisory

ChatGPT

Triage one CVE or OSV-family advisory identifier such as GHSA. Combines OSV/NVD advisory evidence with FIRST EPSS probability and CISA KEV known-exploitation evidence when a CVE identifier is available.