How cisagov/vulnrichment works
Vulnrichment is a public, year-organized collection of CVE records carrying CISA ADP assessments—not an application runtime. The documented workflow assesses CVEs with SSVC, then conditionally adds supported risk metrics in the ADP container without overwriting CNA data; downstream users consume the resulting records through the usual CVE channels. The tree shows the year directories but no implementation source, so links represent documented process and data flow rather than code calls.
Main entry points: 2024 ADP container
Components 13
Risk assessment
- SSVC decisions
- Risk screening
ADP enrichment
- CWE analysis
- CVSS scoring
- KEV status
- Legacy CPE
CVE records
- ADP container
2024 - Yearly CVE data
2024
Data distribution
- GitHub API
- CVE Services API
Other components
- CISA analyst
- CVE records
- Data consumers
Connections 16
- CVE records → SSVC decisions: assessed with
- SSVC decisions → Risk screening: screens risk
- CISA analyst → CWE analysis: analyzes
- CISA analyst → CVSS scoring: scores
- KEV status → ADP container: adds KEV block
- CWE analysis → ADP container: adds CWE
- CVSS scoring → ADP container: adds CVSS
- Legacy CPE → ADP container: historical data
- SSVC decisions → ADP container: adds decisions
- Risk screening → CWE analysis: may trigger
- Risk screening → CVSS scoring: may trigger
- ADP container → Yearly CVE data: stored in
- Yearly CVE data → GitHub API: served through
- Yearly CVE data → CVE Services API: published to
- GitHub API → Data consumers: provides data
- CVE Services API → Data consumers: provides data