cve-triage

name	cve-triage
description	CVE lookup and triage — map discovered services/versions to known CVEs via the cve_lookup tool, score by CVSS/exploitability, and prioritize what to verify first.
routing	{"phases":["vuln_discovery"],"task_types":["triage"]}

CVE Triage

Turn version/banner evidence from recon into a prioritized, exploitability-aware list of CVEs worth verifying. Use this after fingerprinting a service, when a banner or Server: header reveals a product and version, or whenever the target exposes software with a known version.

The cve_lookup tool

VulnClaw ships a read-only cve_lookup tool backed by NVD:

• Keyword search — cve_lookup(query="Apache httpd 2.4.49", limit=5) returns the top CVEs sorted by CVSS, highest first.
• CVE-ID detail — cve_lookup(query="CVE-2021-44228") returns the full record plus best-effort exploit / PoC repositories discovered on GitHub.

It performs no egress to the target and is safe during recon. Without an NVD_API_KEY it still works (lower rate limit); set one for heavier use.

Workflow

1. Extract product + version from recon — service banners, Server headers, JS bundles, login footers, package manifests. A precise version string (OpenSSH 8.2p1, nginx 1.18.0) yields far better matches than a bare name.
2. Query cve_lookup with "<product> <version>". Pull the detail record for any high/critical hit by re-querying its .