# CVE Relationship Graph

> One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS. Looks up a vulnerability in OSV.dev and maps everything connected to it: alias IDs (CVE, GHSA, distro advisories), affected packages with their vulnerable version ranges and fixed versions, fix commits, references grouped into advisories, fixes, reports and exploits, whether CISA lists it as known-exploited (KEV) and its FIRST EPSS exploitation probability.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://cverelationshipgraph.usefulweb.site/ (interactive tool at https://cverelationshipgraph.usefulweb.site/tool)
- JSON API: POST https://cverelationshipgraph.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://cverelationshipgraph.usefulweb.site/api/v1/tool)
- OpenAPI: https://cverelationshipgraph.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://cverelationshipgraph.usefulweb.site/mcp - tool `cve_relationship_graph`

## Inputs
- vulnId (text): CVE, GHSA or OSV id
- osvJson (textarea): Or paste an OSV record (JSON) - Offline mode: an OSV vulnerability JSON, e.g. from api.osv.dev/v1/vulns/<id>.
- kevJson (textarea): Optional: CISA KEV entry or catalog (JSON)
- epssJson (textarea): Optional: EPSS response (JSON) - FIRST API response or {"epss": 0.97, "percentile": 0.99}.
- enrichAliases (boolean): Fetch alias records for packages - If the record lists no packages (typical for CVE records), fetch up to 3 alias advisories.

## Method
- The advisory is read from OSV.dev (https://api.osv.dev/v1/vulns/{id}); CVE records there often carry no package data, so up to 3 alias records (GHSA first) are fetched and merged.
- Version ranges are rendered from OSV events (introduced / fixed / last_affected); GIT ranges become fix-commit nodes. Fixed versions are sorted numerically.
- References are grouped by OSV type, refined with URL patterns: commits and pull requests = fix; NVD, GHSA, vendor PSIRT pages = advisory; issue trackers and mailing lists = report; Exploit-DB, Packet Storm and PoC repositories = exploit.
- KEV membership is checked against the full CISA Known Exploited Vulnerabilities JSON feed; EPSS (probability of exploitation activity in the next 30 days) comes from api.first.org.
- Severity is the source database rating when present, otherwise derived from the CVSS v3.x base score computed from the vector (FIRST formulas).