41ffd49699
This is a security-news tool; CVE enrichment is optional garnish, never a setup tax. Drop the NVD API key from the default path entirely. - internal/cve/cvelist: keyless CVE Program cvelistV5 client (raw GitHub, carries CISA-ADP / vulnrichment CVSS). Parses cna and adp metrics with version precedence v4.0 > v3.1 > v3.0 > v2.0, plus CWE and description; 404 maps to not-found; v2 severity is capped at HIGH. Introduces a neutral CoreResult and a CVESource interface (NVDResult renamed to CoreResult; NVDClient still satisfies it). - enrich: Clients.Core is the CVESource. buildCoreSource picks the keyless cvelist client by default and NVD only when NVD_API_KEY is set (booster). - scrape auto-enriches referenced CVEs best-effort after clustering (time-bounded, non-fatal, --no-enrich to skip); enrich kept as an optional manual refresh. Default flow is scrape -> tui. - ranking default weights rebalanced news-first (recency / velocity / source / keyword 70 percent, cvss / kev / epss 30 percent; was 55 percent CVE). - KAT fixture testdata/cvelist/CVE-2021-44228.json. |
||
|---|---|---|
| .. | ||
| api-security-scanner | ||
| binary-analysis-tool | ||
| credential-enumeration | ||
| credential-rotation-enforcer | ||
| dlp-scanner | ||
| docker-security-audit | ||
| ja3-ja4-tls-fingerprinting | ||
| sbom-generator-vulnerability-matcher | ||
| secrets-scanner | ||
| security-news-scraper | ||
| siem-dashboard | ||