Realtime queries over dependency and vulnerability risk, four faces: the open-source vulnerability store (OSV), CISA's Known Exploited Vulnerabilities catalog (KEV), the ENISA EUVD point lookup and the EU KEV rolling window (0.3.25) — supply-chain due diligence asks whether a dependency has holes, prioritization asks whether anyone is actively exploiting them (US and EU in-the-wild lists side by side). All commands run locally on your machine with no credentials: no platform-side quota, each upstream's own limits apply, and repeats within a cache lifetime are served from your local cache without hitting it.
One section per face: what it answers, the full parameter table and the boundaries. Commands are the flat two-segment names (<domain> <provider>_<dataset>); this domain's corpus faces search / read are documented in the CLI reference.
cisa_kev_catalog**Answers:**CISA's catalog of known exploited vulnerabilities — point-lookup by CVE, or filter to ransomware-exploited entries.
Parameters：
| Flag | Required | Meaning |
|---|---|---|
--cve |
no | CVE id exact lookup (local filter), e.g. CVE-2021-44228 |
--ransomware |
no | Only entries with known ransomware campaign use (local filter) |
--limit |
no | Rows (default 50; page through the catalog instead of dumping it) |
Boundary:--cve / --ransomware are local post-filters (the upstream call stays empty-param pure); the catalog updates weekly, catalogVersion echoed in reason; default 50 rows — page for the rest instead of pulling everything.
euvd_exploited**Answers:**ENISA's rolling window of vulnerabilities currently exploited in the wild (the EU KEV) — the EU-side list of what is being actively attacked.
Parameters：
| Flag | Required | Meaning |
|---|---|---|
--limit |
no | Rows (default 50; the EU KEV rolling window is small but grows) |
**Boundary:**one call returns the whole rolling window (no upstream params), --limit is a local slice only; the total rides along; the 399k-row EUVD↔CVE full mapping is a raw-side bulk artifact, not this face.
euvd_vulnerability**Answers:**The full EUVD record for one vulnerability — point lookup by CVE or EUVD code, richer than the public NVD face (CVSS vector+version, EPSS, exploitation date, member-state CSAF advisories).
Parameters：
| Flag | Required | Meaning |
|---|---|---|
--id |
yes | CVE or EUVD code (e.g. CVE-2024-3400 / EUVD-2024-31989; required) — the single-record full lookup |
**Boundary:**the id form is validated locally (CVE-2024-3400 / EUVD-2024-31989); an unknown code = a clean not-found; upstream dates arrive in Java format and are ISO-normalized locally; advisory links point back at the EUVD record page.
osv_vulns**Answers:**Known vulnerabilities for one open-source package — by ecosystem + name, optionally narrowed to a version.
Parameters：
| Flag | Required | Meaning |
|---|---|---|
--package |
yes | Package name, e.g. lodash (required) |
--ecosystem |
yes | OSV ecosystem (npm / PyPI / Go / Maven / crates.io / RubyGems / NuGet / Packagist / Debian / Alpine / Linux / OSS-Fuzz / Hex / Pub / Conda / Android / GitHub Actions; required) |
--version |
no | Package version (omit = all known vulns) |
--page-token |
no | Continuation token (feed result.next_page_token from the prior response; the upstream paginates past 1000 vulns or 20 seconds) |
**Boundary:**the ecosystem is a closed set (npm / PyPI / Go / Maven / crates.io / RubyGems / NuGet …) validated locally — unknown values silently return empty upstream; omitting version = all known vulns for the package; upstream pages past 1,000 vulns or 20 seconds — echo next_page_token back to continue.
The command surface of this domain is the flat, two-part names (<domain> <provider>_<dataset>) — the table below lists every direct-lookup face. This table is generated from the CLI's own --help, so it tracks the code exactly; full parameter tables are in the CLI reference.
| Command | Jurisdiction | What it answers |
|---|---|---|
security cisa_kev_catalog |
US | CISA Known Exploited Vulnerabilities catalog (weekly) |
security euvd_exploited |
EU | ENISA EU KEV rolling window (EU in-the-wild exploitation list) |
security euvd_vulnerability |
EU | ENISA EUVD single-vulnerability full record (CVE/EUVD code) |
security osv_vulns |
GLOBAL | Open-source package vulnerability query (OSV, ecosystem + version) |