PERSONAL PROJECT

CVE Watchlist — Real-Time NVD Vulnerability Triage

Vulnerability triage dashboard syncing real CVE data from the public NVD API, ranked by a transparent priority-scoring engine that cross-references CVSS severity with CISA's Known Exploited Vulnerabilities (KEV) catalog.

Context

A CVSS score alone doesn't say what to patch first. This dashboard encodes that judgment call into an explicit, documented formula instead of leaving it to the raw CVSS number.

What I built

httpx-based NVD API v2.0 client with response parsing for CVSS v3.1/v2 metrics
Pure scoring engine (scoring.py) combining CVSS base score, CISA KEV exploitation flag, attack vector, and recency into a 0-100 priority score
SQLAlchemy upsert logic so re-syncing updates existing CVEs instead of duplicating them
React dashboard with severity-band filters and a manual Sync from NVD action
13 Pytest tests, with the NVD client mocked so the suite never depends on live network

Verified live

100

CVEs synced

Real NVD data, last 30 days

89/100

Top priority score

CVE-2018-1273, Spring Data RCE

Actively exploited (KEV)

Correctly cross-referenced

Screenshots