​

CVE Intelligence

Beyond audits, Golem maintains a live catalog of published vulnerabilities and tracks your apps’ exposure to them.

​

The catalog

The catalog contains every published CVE from NVD, enriched with:

• CVSS scores — severity scoring for every record
• CISA KEV — whether the CVE is in the Known Exploited Vulnerabilities catalog
• FIRST EPSS — exploitation probability scores

The catalog is refreshed daily from NVD, CISA, and FIRST. You can also trigger a manual sync from the CVE pages.

​

Browsing

• Global browser — /cves gives you the full catalog: search by ID or keyword, filter to KEV-only, set a minimum CVSS, and sort by CVSS, EPSS, or publish date
• Per-app browser — each app has its own CVE browser scoped to the app’s identity and tech stack
• Detail pages — every CVE has a full detail view with description, references, and scores

​

Exposure tracking

This is where the catalog connects to your audits. When an audit finding maps to a published CVE, Golem records an exposure for that app:

• Open — a recent audit confirmed the vulnerability is still present
• Fixed — a subsequent audit no longer detects it
• Reopened — it reappeared after being marked fixed

Each app has an exposure history timeline, so you can see exactly when issues appeared and when they were resolved. KEV-listed and critical exposures surface prominently and drive notifications.

​

What the catalog is not

The CVE catalog is display-only intelligence. It never feeds into the audit agent — findings come exclusively from what Golem actually observes against your targets. The catalog exists so that when an audit confirms a vulnerability, you get the full industry context (CVSS, KEV, EPSS) attached to it, and so you can research any CVE independently.

​

Next steps