cvlabsio / cvetrends

cvet is a Python utility for pulling actionable vulnerabilities from cvetrends.com

cvet

cvet is a Python utility for pulling actionable vulnerabilities from cvetrends.com.

Find out more information at our blog.

Installation / Usage

Installation

cvet can be installed from PyPi using the following command:

pipx install cvetrends

If this tool is not yet availible via PyPi, you can install it directly from the repository using:

git clone https://github.com/Sprocket-Security/cvetrends.git
cd cvetrends && pip3 install .

For development, clone the repository and install it locally using poetry.

git clone https://github.com/Sprocket-Security/cvetrends.git && cd cvetrends
poetry shell 
poetry install

Usage

The cvet help menu is shown below:

 Usage: cvet [OPTIONS] [[day|week]]                                                                                              
                                                                                                                                 
 cvetrends.com CLI                                                                                                               
                                                                                                                                 
╭─ Arguments ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ TIME_FRAME    [[day|week]]                                                                                                    │
╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Options ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ --notify          -n   TEXT     Slack webhook to notify on run                                                                │
│ --repo-threshold  -rt  INTEGER  Number of repos needed to show CVE. [default: 1]                                              │
│ --help            -h            Show this message and exit.                                                                   │
╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

cvet can query time frames of 24 hours or 7 days using a value of day or week. The default is day.

cvet week 

Results are returned in a pretty table format and only vulnerabilities that have more than -rt PoC GitHub repos published are shown. The default is 1.

cvet day -rt 2

cvet also allows you to specify a Slack webhook to notify on run using the -n or --notify flag. This is useful if you want to be notified of new vulnerabilities and run this tool on a cron.

cvet -n https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX -rt 2 

An example Slack notification is shown below: