vulnerability-context-enricher

You can enrich CVE data by providing Trivy scan results or individual CVE IDs to the script. It aggregates vulnerability intelligence from NVD, OSV.dev, EPSS, and CISA KEV into a single structured JSON profile with plain-language summaries.

Prioritize CVE remediation by computing a composite priority score that combines EPSS exploit likelihood with CISA KEV inclusion. This approach maps CWEs to ATT&CK techniques, delivering actionable risk scores and structured guidance for engineering teams.

Mapping CWE to MITRE ATT&CK contextualizes vulnerability data by connecting software weaknesses to adversary tactics and techniques. This enrichment helps engineering teams understand exploit potential and prioritize remediation based on real-world threat behavior.

Yes, the Skill supports batch and on-demand lookup, allowing you to process lists of CVEs from tools like Trivy. It fetches multi-source intelligence from NVD, OSV.dev, EPSS, and CISA KEV to generate enriched profiles for each identified vulnerability.

Yes, it fetches and aggregates vulnerability context from both OSV.dev and CISA KEV, alongside NVD and EPSS. This multi-source enrichment unifies disparate vulnerability intelligence into a single actionable profile for engineers.

The enricher outputs structured JSON containing the aggregated CVE data, computed composite priority scores, CWE to ATT&CK mappings, and a plain-language summary. This format is designed to be easily consumed by engineering tools and automated workflows.