OpenCVE

OpenCVE is a CVE monitoring platform: a searchable catalog of every published CVE with its CVSS scores, EPSS probability, CISA KEV status, affected vendors, products and versions, and references. Your OpenCVE organization also holds projects, which follow the vendors and products you choose and track each matching CVE’s triage status. Connect it, and Neo agents can explain a CVE named in a ticket, find which of a client’s devices run an affected version, and keep a project’s CVE triage up to date.

​

What Neo can do with OpenCVE

• CVE lookup: a CVE’s CVSS scores (2.0 to 4.0, with who scored it), EPSS probability, CISA KEV status and due date, SSVC exploitation, affected vendors, products and version ranges, weaknesses, references and fixes, and its publication and update dates
• CVE search: CVEs by vendor, product, CVSS, EPSS, KEV status, keyword and date, with OpenCVE’s search syntax
• Exposure check: match a CVE’s affected versions against the client’s software in Datto RMM and other RMMs, network devices in Auvik, configurations in IT Glue and assets in your PSA, and note what is affected on the ticket
• Projects and triage: read a project’s CVEs and reports, and set a CVE’s triage status and assignee
• Subscriptions, notifications and automations: read and change what each project follows, where its alerts go and the rules that act on them
• Organization: read your members and the audit log, and invite or change members

See OpenCVE API for the permission groups.

​

Checking a CVE against your clients

OpenCVE knows the CVE; your RMM, network monitor, documentation and PSA know what each client runs. An agent reads each through its own Neo integration, so give the agent the integrations it should check, each with read access: for example the software audit in Datto RMM, the inventory in Auvik and the configurations in IT Glue. The agent reports each affected device with its version, and calls a device whose version it cannot read “unknown”, never “not affected”.

​

Your API call limit

OpenCVE limits API calls per hour by plan (100 an hour on Free). A CVE lookup is one call; a fleet check reads OpenCVE once per CVE and your RMM for the inventory. When the limit is reached, the agent stops and reports what it has.

​

Next steps