pyvfeed - Python CLI for vFeed Vulnerability and Threat Intelligence

pyvfeed is a Python command-line tool for querying the vFeed correlated vulnerability and threat intelligence database. It produces structured JSON output covering CVE information, CVSS 2/3/4 scoring, EPSS, KEV, MITRE ATT&CK, advisories, exploits, patches, detection rules, and more.

Requirements

Python 3.9+
boto3 — licensed DB updates via AWS S3
pyyaml — YAML export support
urllib3 / stdlib urllib — demo DB download

Install all dependencies:

pip install -r requirements.txt

Quick Start

1. Download the demo DB

Downloads the demo vFeed DB and checks for updates automatically.

python pyvfeed.py --download-demo-db
[+] Checking demo DB update status ...
    [-] Fetching remote checksum from '...' ...
    [-] Remote checksum: a3f1...
    [-] Downloading demo DB 'vfeed.db.tgz' ...
    [-] Unpacking ...
[+] Cleaning tmp downloads ...

2. Set the DB file permanently

Save the DB path so every subsequent command uses it without needing --db:

python pyvfeed.py --set-dbfile /path/to/vfeed.db
[+] DB file saved to /path/to/pyvfeed/.pyvfeedrc: /path/to/vfeed.db

This writes a .pyvfeedrc file in the project directory. All future runs pick it up automatically.

3. Override the DB for a single run

Use --db to point at a different database without changing .pyvfeedrc:

python pyvfeed.py --db /tmp/other.db --information CVE-2017-9805

DB resolution order: common/config.py → .pyvfeedrc → --db

Database Management

Show DB schema

python pyvfeed.py --schema

Prints all CREATE TABLE and CREATE INDEX statements from the SQLite3 DB.

Update licensed DB

Requires valid subscription keys in common/config.py:

python pyvfeed.py --update
[+] Checking update status ...
    [-] Checksum verification a3f1...
    [-] Already updated
[+] Cleaning tmp downloads ...

If the local DB is out of date, it downloads and unpacks the latest version automatically.

Version info

python pyvfeed.py --version
{
  "title": "Python CLI for vFeed Vulnerability and Threat Intelligence - Pro Edition",
  "build": "2.0.0",
  "support": "support@vfeed.io"
}

Vulnerability Queries

All query commands accept a CVE or CPE identifier and return JSON.

Information

Basic vulnerability metadata including NVD status and triage flags when available.

python pyvfeed.py --information CVE-2017-9805
{
  "information": {
    "description": [
      {
        "id": "CVE-2017-9805",
        "parameters": {
          "published": "2017-09-05T17:29Z",
          "modified": "2019-10-03T00:03Z",
          "summary": "The REST Plugin in Apache Struts 2.1.2 ...",
          "vuln_status": "Analyzed",
          "source_identifier": "security@apache.org",
          "has_exploits": true,
          "has_kev_cisa": true,
          "has_patches": true,
          "has_advisory": true,
          "risk_score": 0.94
        }
      }
    ],
    "references": [
      { "vendor": "MISC", "url": "https://..." }
    ]
  }
}

Classification

CPE targets, affected packages and CWE weaknesses with MITRE ATT&CK ranking.

python pyvfeed.py --classification CVE-2017-9805

Risk

CVSS 2, CVSS 3, CVSS 4 (when available), EPSS probability and CISA KEV catalog entry.

python pyvfeed.py --risk CVE-2017-9805
{
  "risk": {
    "cvss": {
      "cvss2": {
        "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
        "base_score": "6.8",
        ...
      },
      "cvss3": {
        "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
        "base_score": "8.1",
        ...
      },
      "cvss4": {
        "vector": "CVSS:4.0/AV:N/AC:L/...",
        "base_score": "9.3",
        ...
      }
    },
    "epss": {
      "probability": 0.95975,
      "percentile": 0.99987
    },
    "kev": {
      "id": "CISA:BOD 22-01",
      "parameters": {
        "date_added": "2021-11-03",
        "date_due": "2022-05-03",
        "name": "Apache Struts Multiple Versions Remote Code Execution Vulnerability",
        "vendor": "Apache",
        "product": "Struts",
        "required_action": "Apply updates per vendor instructions.",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
      }
    }
  }
}

cvss4 is omitted when no CVSS 4.0 entry exists for the CVE.

Advisory

Top advisories from the advisory database for a given CVE.

python pyvfeed.py --advisory CVE-2017-9805
[
  {
    "type": "vendor",
    "source": "Apache",
    "id": "S2-052",
    "link": "https://cwiki.apache.org/confluence/display/WW/S2-052"
  },
  ...
]

MITRE CWE and ATT&CK

CWE weaknesses and resolved ATT&CK techniques via the CVE → CWE → CAPEC → ATT&CK chain.

python pyvfeed.py --mitre CVE-2017-9805
{
  "cve_id": "CVE-2017-9805",
  "weaknesses": [
    {
      "cwe_id": "CWE-502",
      "title": "Deserialization of Untrusted Data",
      "class": "weakness",
      "url": "https://cwe.mitre.org/data/definitions/502.html",
      "attack_techniques": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "tactic": "execution",
          "description": "...",
          "url": "https://attack.mitre.org/techniques/T1059/"
        }
      ]
    }
  ]
}

Inspection

Remote and local vulnerability scanner signatures (Nessus, OpenVAS, etc.).

python pyvfeed.py --inspection CVE-2017-9805

Exploitation

Exploits and PoCs from ExploitDB, Metasploit and other sources.

python pyvfeed.py --exploitation CVE-2017-9805

Defense

Vendor patches, security bulletins, IDS/IPS rules (Snort, Suricata, Juniper).

python pyvfeed.py --defense CVE-2017-9805

Export

Export all metadata for a CVE to a JSON file in the configured export path.

python pyvfeed.py --export CVE-2017-9805
# Produces: CVE-2017-9805.json

Search

Search by CVE

Returns basic info and any available exploits.

python pyvfeed.py --search cve CVE-2017-9805

Search by CPE

Accepts both CPE 2.2 (cpe:/) and CPE 2.3 (cpe:2.3:) formats.

python pyvfeed.py --search cpe "cpe:2.3:a:apache:struts:2.3.5:*:*:*:*:*:*:*"
python pyvfeed.py --search cpe "cpe:/a:apache:struts:2.3.5"

Search by CWE

Returns all CVEs associated with a CWE identifier.

python pyvfeed.py --search cwe CWE-502
{
  "id": "CWE-502",
  "parameters": {
    "title": "Deserialization of Untrusted Data",
    "class": "weakness",
    "url": "https://cwe.mitre.org/data/definitions/502.html"
  },
  "vulnerability": [
    "CVE-2017-9805",
    "CVE-2019-0232",
    ...
  ]
}

Language Vulnerabilities

List CVEs related to a programming language, enriched with CVSS scores and metadata.

python pyvfeed.py --lang python
python pyvfeed.py --lang cpp
python pyvfeed.py --lang javascript
python pyvfeed.py --lang golang
python pyvfeed.py --lang java

Example output entry:

{
  "cve_id": "CVE-2021-3177",
  "summary": "Python 3.x through 3.9.1 has a buffer overflow ...",
  "cvss3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "cpe23_id": "cpe:2.3:a:python:python:3.9.0:*:*:*:*:*:*:*",
  "cvss4_vector": "CVSS:4.0/AV:N/AC:L/...",
  "cvss4_base": "9.3",
  "vuln_status": "Analyzed",
  "has_exploits": true,
  "risk_score": 0.87
}

Package Vulnerabilities

List CVEs affecting a specific package, with an optional version range filter.

# All versions
python pyvfeed.py --pkgs wordpress

# Specific version range
python pyvfeed.py --pkgs openssl 1.0.1

Configuration

common/config.py

Default database and export paths, and subscription keys for licensed DB updates:

database = {
    "file": "vfeed.db",
    "path": "./"
}

export = {"path": "/tmp"}

subscription = {
    "access_key": "YOUR_ACCESS_KEY",
    "secret_key": "YOUR_SECRET_KEY",
    "plan":       "YOUR_PLAN"
}

.pyvfeedrc

Created automatically by --set-dbfile. Stored in the project directory:

{
  "dbfile": "/path/to/vfeed.db"
}

Full Help

python pyvfeed.py --help

usage: pyvfeed [-h] [--db FILE] [--set-dbfile FILE] [--schema] [--update]
               [--download-demo-db] [--information CVE|CPE]
               [--classification CVE|CPE] [--risk CVE|CPE]
               [--inspection CVE|CPE] [--exploitation CVE|CPE]
               [--defense CVE|CPE] [--advisory CVE] [--mitre CVE]
               [--export CVE|CPE] [--search TYPE ID] [--lang LANGUAGE]
               [--pkgs PACKAGE [PACKAGE ...]] [--version] [--plugin NAME TARGET]

Python CLI for vFeed Vulnerability and Threat Intelligence - Pro Edition

database:
  --db FILE            SQLite3 DB file to use (overrides config and .pyvfeedrc)
  --set-dbfile FILE    Permanently save DB file path to .pyvfeedrc
  --schema             Print DB schema to stdout
  --update             Update the vFeed database
  --download-demo-db   Download demo vFeed DB

vulnerability queries:
  --information CVE|CPE
  --classification CVE|CPE
  --risk CVE|CPE
  --inspection CVE|CPE
  --exploitation CVE|CPE
  --defense CVE|CPE
  --advisory CVE
  --mitre CVE
  --export CVE|CPE

search:
  --search TYPE ID     Search by type (cpe, cve, cwe) and identifier
  --lang LANGUAGE      List CVEs for a language
  --pkgs PACKAGE ...   List CVEs for a package and optional version

miscellaneous:
  --version            Show version and build info
  --plugin NAME TARGET Load and run a third-party plugin

Name		Name	Last commit message	Last commit date
Latest commit History 33 Commits
common		common
core		core
lib		lib
schema		schema
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
MANIFEST.in		MANIFEST.in
README.md		README.md
pyproject.toml		pyproject.toml
pyvfeed.py		pyvfeed.py
requirements.txt		requirements.txt

Folders and files

Latest commit

History

Repository files navigation

pyvfeed - Python CLI for vFeed Vulnerability and Threat Intelligence

Requirements

Quick Start

1. Download the demo DB

2. Set the DB file permanently

3. Override the DB for a single run

Database Management

Show DB schema

Update licensed DB

Version info

Vulnerability Queries

Information

Classification

Risk

Advisory

MITRE CWE and ATT&CK

Inspection

Exploitation

Defense

Export

Search

Search by CVE

Search by CPE

Search by CWE

Language Vulnerabilities

Package Vulnerabilities

Configuration

common/config.py

.pyvfeedrc

Full Help

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Packages