Umbra
Start free
← All docs

CVE matching + KEV

Every fingerprinted service gets matched against NVD + Trickest + curated intel; CISA KEV listings surface first.

Last updated May 27, 2026

What it is

A continuously-updated CVE database joined to your fingerprinted services via CPE. Three sources stack:

  • NVD: official CVE catalogue with CVSS / CWE / references
  • Trickest CVE feed: curated PoC links + real exploit code pointers, refreshed daily
  • Curated seed: Umbra’s own product-to-CPE mapping for the long tail (ICS / OT / niche enterprise software that NVD’s CPE dictionary covers poorly)

KEV (CISA’s Known-Exploited Vulnerabilities catalogue) is layered on top. KEV-listed CVEs get a badge and surface first in every sort.

What it produces

Per service:

  • A list of (cve_id, severity, cvss_score, kev_listed, has_poc, poc_links, summary) tuples
  • A roll-up count: cve_count, kev_count, critical_count
  • A material compromised flag once AI validation confirms one of them (see per-CVE validation)

What to use it for

  • Triaging the queue: filter by kev:true severity:critical
  • Compliance evidence: “we have 0 unpatched KEVs on the PCI surface as of today”
  • Driving the AI exploit engine: AI validation defaults to the highest-severity unverified CVE on each service

Why it matters

Every external CVE-matching tool ships you the same false-positive rate: “your nginx version might be vulnerable to X.” Pairing CPE matching with KEV filtering + AI validation collapses the queue from “thousands of maybes” to “tens of yes-this-one-is-real.”

Why it’s valuable

  • Multi-source, no vendor lock-in. NVD + Trickest + curated intel means the matcher doesn’t go dark when one source rate- limits or stops updating.
  • KEV-first sorting. The findings list defaults to KEV-listed → severity-critical → has-PoC, so the first row is always the one to look at.
  • Per-service granularity. Every detected product on a service contributes its CVE set (a WordPress site on nginx with an old jQuery gets the union, not just one).

How to use it

CVE matching runs automatically after fingerprinting. Browse the Findings dashboard or filter inventory in SmartSearch:

kev:true                          # all KEV-listed exposure
cve_severity:critical             # critical CVEs only
cve:CVE-2023-44487                # specific CVE
has_cve:true compromised:false    # CVEs we haven't yet validated