usefulweb.site CVE Relationship Graph

Security & supply-chain explorers

CVE Relationship Graph

One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.

Offline mode: an OSV vulnerability JSON, e.g. from api.osv.dev/v1/vulns/<id>.

FIRST API response or {"epss": 0.97, "percentile": 0.99}.

If the record lists no packages (typical for CVE records), fetch up to 3 alias advisories.

Try an example: Log4Shell from pasted OSV + KEV + EPSS (offline)

How it works

Looks up a vulnerability in OSV.dev and maps everything connected to it: alias IDs (CVE, GHSA, distro advisories), affected packages with their vulnerable version ranges and fixed versions, fix commits, references grouped into advisories, fixes, reports and exploits, whether CISA lists it as known-exploited (KEV) and its FIRST EPSS exploitation probability.

  • The advisory is read from OSV.dev (https://api.osv.dev/v1/vulns/{id}); CVE records there often carry no package data, so up to 3 alias records (GHSA first) are fetched and merged.
  • Version ranges are rendered from OSV events (introduced / fixed / last_affected); GIT ranges become fix-commit nodes. Fixed versions are sorted numerically.
  • References are grouped by OSV type, refined with URL patterns: commits and pull requests = fix; NVD, GHSA, vendor PSIRT pages = advisory; issue trackers and mailing lists = report; Exploit-DB, Packet Storm and PoC repositories = exploit.
  • KEV membership is checked against the full CISA Known Exploited Vulnerabilities JSON feed; EPSS (probability of exploitation activity in the next 30 days) comes from api.first.org.
  • Severity is the source database rating when present, otherwise derived from the CVSS v3.x base score computed from the vector (FIRST formulas).

For scripts and AI agents

  • JSON API: POST https://cverelationshipgraph.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://cverelationshipgraph.usefulweb.site/mcp · tool name cve_relationship_graph
Example request
curl -s -X POST https://cverelationshipgraph.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

  • Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.
  • SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.
  • Container Image Explorer – Inspect a container image: platforms, layers, base image, root user, labels and cosign signature.
Feedback