Open-source CVE triage in one place: KEV, EPSS, NVD and OSV combined into a single risk score

CVE Intel is a native Rust open-source project that consolidates data from 31 tools and 25 public security sources to assist vulnerability triage. It queries multiple sources in parallel to provide a unified risk score and patch prioritization advice, incorporating severity, exploitation probability, and known active exploitation status (e.g., CISA KEV list items are marked critical). The tool supports multiple interfaces including desktop, CLI, REST API, and integration with AI coding assistants via MCP. It features a local AI model for natural language explanations of vulnerability data, with optional cloud AI providers. CVE Intel does not perform scanning or remediation but serves as an intelligence aggregator and decision support tool for security teams.

This tool improves the efficiency and accuracy of vulnerability triage by consolidating disparate public vulnerability data sources into a single actionable risk score and prioritization recommendation. It reduces manual effort in assessing CVEs and related indicators, enabling faster and more informed patching decisions. It does not itself introduce vulnerabilities or perform scanning/remediation, so its impact is on improving security operations rather than creating new risks.

No direct mitigation is required as this is a security intelligence tool rather than a vulnerability. Organizations can adopt CVE Intel to enhance their vulnerability management processes by integrating it into their workflows. Since it does not scan or remediate, standard vulnerability management practices remain necessary. The tool is open-source and MIT licensed, allowing customization and contribution. Users should ensure they keep the tool updated and verify the currency of public data sources it queries.