csaf

Library to ingest and generate VEX documents

A CVRF CSAF Converter, taking care about OASIS specification.

CSAF generator and validator

Experimental CSAF envelope and body profile validator.

CSAF Backend PoC

Vulnerability advisories automatically enriched (AI-Assisted and VL metadata) in CSAF 2.1 format

Multi-vendor CVE / vulnerability aggregation system — syncs 20+ sources into one unified schema, served over GraphQL.

Match ICS/OT security advisories to your asset inventory. CSAF-native, offline, order-numbers-first because CPE covers 0.1% of the corpus.

Coordinated vulnerability disclosure, the CVE Program, CSAF, VEX and vulnerability scoring as an OKF bundle for Meerkat and MCP

Which devices in your plant have published vulnerabilities, and which firmware fixes them

OT Asset Intelligence (Korea) — OT 자산 취약점·공격 경로 관리 플랫폼. Evidence-graded applicability (three-valued logic, 9 states), capability-transition attack paths, action queue with hard rules. On-premises, air-gapped first.

CRA Article 14 dossiers from an embedded Linux build tree. Scan Yocto or Buildroot, decide affectedness with the evidence shown, emit CSAF, OpenVEX and SRP with the statutory clock running. Zero runtime dependencies, offline-capable.

Python API and CLI for CSAF 2.0 and VEX validation using Secvisogram's validator, with CI-friendly unavailable-validator handling.