Track and Manage CVEs for Enhanced Security

This skill provides expertise in building Common Vulnerabilities and Exposures (CVE) tracking systems, vulnerability management, and security compliance frameworks, with deep knowledge of CVE databases, CVSS scoring, vulnerability assessment workflows, and automated security monitoring. Core CVE tracking principles cover data structure and standards - the CVE-YYYY-NNNN ID format, CVSS v3.1 base/temporal/environmental metrics, CWE (Common Weakness Enumeration) category mapping, CPE (Common Platform Enumeration) for asset identification, and integrating data from NVD, MITRE, vendor advisories, and threat intelligence feeds. System architecture components cover data ingestion (automated feeds from multiple vulnerability sources), asset inventory (comprehensive software/hardware tracking), risk assessment (automated CVSS scoring with environmental adjustments), workflow management (triage, assessment, remediation, verification), and a reporting engine (compliance reports, dashboards, executive summaries).

CVE data ingestion covers a concrete NVD API integration class that fetches recently published CVEs within a configurable time window and parses each entry into a structured record (CVE ID, dates, description, CVSS base score, severity, CWE IDs, affected products/CPEs). CVSS score calculation implements the actual CVSS v3.1 base-score formula - deriving Impact Sub-Score (ISS) from confidentiality/integrity/availability metrics, computing exploitability from attack vector/complexity/privileges required/user interaction, and combining them (with a scope-adjusted formula) into a final base score capped at 10.0.

Asset management and CPE matching covers a software asset inventory manager that registers assets with name/version/vendor and either an explicit or generated CPE string, then matches assets against CVE data by CPE string comparison to produce a list of asset-to-CVE vulnerability matches with their CVSS score and severity, feeding directly into workflow management for triage and remediation tracking.

Use this skill when building or operating a CVE tracking and vulnerability management system - NVD data ingestion, CVSS scoring, asset-to-vulnerability matching, and remediation workflow. It is well suited to security teams maintaining a software/hardware asset inventory that needs continuous vulnerability monitoring. It is not meant for a one-off manual CVE lookup with no ongoing tracking system, or for organizations with no asset inventory to match vulnerabilities against.

Input: the organization's software/hardware asset inventory and the CVE data sources to monitor.

Output: ingested and parsed CVE records, calculated CVSS scores, asset-to-vulnerability matches, and a remediation workflow. Example CVE parsing output structure:

return {
    'cve_id': cve['id'],
    'cvss_base_score': self.extract_cvss_score(cve),
    'severity': self.extract_severity(cve),
    'cwe_ids': self.extract_cwe_ids(cve),
    'affected_products': self.extract_cpe_data(cve)
}

Integrates with the NVD (National Vulnerability Database) API, MITRE CVE/CWE data, and CPE-based asset matching using Python.

Security and vulnerability management teams building or operating a CVE tracking system, and organizations that need automated CVSS scoring and asset-vulnerability matching rather than manual CVE monitoring.