Security
CVE intelligence
CVE records, CISA SSVC, EPSS and KEV data that rank findings by real-world risk.
The worker keeps these facts for every CVE a finding or its aliases name:
| Fact | Source | Refreshed |
|---|---|---|
| Title, description, CWEs, references, CVSS (CNA's first, newest version first) | CVE record (CVE JSON 5) | weekly, at most 400 records per hourly run |
| CISA SSVC: exploitation, automatable, technical impact | CISA's ADP container in the record | with the record |
| EPSS: 30-day exploitation probability and percentile | FIRST EPSS | daily |
| Known exploited, ransomware use, due date | CISA KEV | every 6 hours |
In the UI
- Security → CVEs lists your artifacts' CVEs, known exploited first, then by EPSS, with filters and sorts. A CVE appears as soon as a scan's finding names it; its facts follow with the next refresh of each source. A CVE's page shows every artifact it affects.
- Security → Vulnerabilities shows each finding's EPSS and a KEV badge.
Feeds
The worker connects only to RELIC_CVE_EPSS_URL, RELIC_CVE_KEV_URL and
RELIC_CVE_RECORDS_URL. Set them to internal mirrors or off
(Configuration).
API
Viewers and administrators can call relic.v1.ScanService/ListCves and
relic.v1.ScanService/GetCve.