CVE Alerting Platform

Are you aware of https://github.com/nexB/vulnerablecode? which offers a similar solution, is also open source and written in Python.

> During the import of initial data OpenCVE will download and parse huge files, like the CPE dictionnary. For that we recommend you 3.5G RAM at least.

Why oh why are streaming parsers not used?

Debian has another solution for this, also written in Python:

https://security-tracker.debian.org/tracker/

This is a great self-hosted solution!

We built CyberSentinel (https://www.insurtechnix.com/) to solve two problems with this approach. Firstly the raw CVE feed is quite "noisy" so you need almost full NLP to get the best out. Secondly most organisations find it challenging to get an inventory of all their SW.

We also prioritize CVEs according to whether they have exploit code, and also whether they are targeted by exploit kits. There are only about 2 dozen CVEs at any time that are exploit kit targets, so patching just those gives a huge security ROI.

I use the NVD feed directly:

https://nvd.nist.gov/feeds/xml/cve/misc/nvd-rss-analyzed.xml

then filter out stuff I am not interested in using the filtering features of my RSS feed reader, but the feed is so comprehensive with all sorts of reports on obscure commercial packages I've never even heard about, and with relatively poor metadata about the packages (so you can't just filter out "anything having to do with Windows since I don't use Windows").

The usage of 'open' in the name is misguided.

I didn’t realize there were so many CVE-based tools out there! I even have an ultra-specific one for PHP (with some extra logic for support timelines). PHP Version Audit: https://www.github.developerdan.com/php-version-audit/

One thing I’ve noticed with PHP at least, is that their release docs will regularly have the CVE listed with the details for many days before it shows up in the CVE feed- even as long as a week. Sourcing only from the feeds is a bit slow, but perhaps that is limited to the process that PHP uses?

My startup is providing a somewhat similar service to our customers. However, we also provide intel on suspicious activity regarding the customer's software on social media and on forums. This way our beta testers were able to prevent the OWA hacks that happened a few weeks ago. It's primarily targeted towards small and medium business that usually lack some deeper knowledge in cyber security and can't monitor this stuff themselves.

There is also https://dependencytrack.org/ which allows you to gather your software dependencies and notifies you when new vulnerabilities are found for them.

Nice,

I once had the idea to create a CVE/Bounty platform running on Ethereum:

- wp:https://github.com/0xdefaceme/whitepaper

Not a huge fan of managing something as critical like this. GitHub has a dependancy management tool and also Snyk is a great addition to our pipeline for code packages and Docker Images.

Using both in production.