sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

CS-B1 · CVE matcher (OSV.dev + NVD) #102

New Issue
Open
opened 2026-07-03 08:03:57 +00:00 by sharang · 0 comments
sharang commented 2026-07-03 08:03:57 +00:00
Owner
Copy Link
Copy Source

Epic: B — Vulnerabilities + VEX
Crate: compliance-agent / compliance-core · Effort: 3d · Mode: Automated · Depends: CS-A3

Match each component (purl/CPE) against OSV.dev + an NVD offline feed; store findings with CVSS.

Epic acceptance: every CVE gets a CVSS + AI-drafted VEX status + rationale; analyst can accept/reject; decision is logged.

**Epic:** B — Vulnerabilities + VEX **Crate:** compliance-agent / compliance-core · **Effort:** 3d · **Mode:** Automated · **Depends:** CS-A3 Match each component (purl/CPE) against OSV.dev + an NVD offline feed; store findings with CVSS. **Epic acceptance:** every CVE gets a CVSS + AI-drafted VEX status + rationale; analyst can accept/reject; decision is logged.
sharang added this to the P0 Demo milestone 2026-07-03 08:03:57 +00:00
sharang added the P0-demo label 2026-07-03 08:03:57 +00:00
sharang added a new dependency 2026-07-03 08:10:12 +00:00
#100 CS-A3 · SBOM data model + Mongo repo
sharang added a new dependency 2026-07-03 08:10:12 +00:00
#103 CS-B2 · ICS advisory ingest (CISA ICS-CERT CSAF)
sharang added a new dependency 2026-07-03 08:10:12 +00:00
#104 CS-B3 · LLM VEX triage → OpenVEX
sharang added a new dependency 2026-07-03 08:10:12 +00:00
#107 CS-C2 · Mapping engine (findings → controls → status)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels P0-demo
Milestone
No items
No Milestone P0 Demo
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Blocks
#103 CS-B2 · ICS advisory ingest (CISA ICS-CERT CSAF)
sharang/compliance-scanner-agent
#104 CS-B3 · LLM VEX triage → OpenVEX
sharang/compliance-scanner-agent
#107 CS-C2 · Mapping engine (findings → controls → status)
sharang/compliance-scanner-agent
Depends on
#100 CS-A3 · SBOM data model + Mongo repo
sharang/compliance-scanner-agent
Reference: sharang/compliance-scanner-agent#102