NostromoHub/cve-kev-snapshot-90d-2025-09-04

CVE-KEV Snapshot (one-time, offline bundle)

This bundle lets you rank likely exploited CVEs and cite official sources without any APIs or accounts, fully offline. It’s a one-time snapshot of the last 90 days of NVD, aligned with CISA KEV for immediate focus on likely exploited CVEs. Query-ready Parquet tables and an optional small RAG pack let you rank by severity, pivot by CWE, and fetch references for briefings. Every row includes provenance; validation metrics and an integrity manifest are included. The compiled dataset is dedicated to the public domain (CC0).

Quick start (60 seconds)

• —Open demo/OVX_quickstart.html (no network) or demo/OVX_quickstart.ipynb.
• —Or run this DuckDB query for top KEV CVEs by severity:

SELECT c.cve_id, m.cvss_v3_score, k.date_added
FROM read_parquet('parquet/kev.parquet') k
JOIN read_parquet('parquet/cve.parquet') c USING (cve_id)
LEFT JOIN read_parquet('parquet/nvd_meta.parquet') m USING (cve_id)
ORDER BY (m.cvss_v3_score IS NULL) ASC, m.cvss_v3_score DESC, k.date_added DESC
LIMIT 20;

Snapshot

• —Snapshot as of (UTC): 2025-09-05T02:12:27Z
• —NVD window (days): 90

Accuracy at a glance

• —Total CVE rows: 11,344
• —Total KEV rows: 27
• —Artifacts: Validation Report · Integrity Check · Build Manifest
• —KEV is window‑aligned; within‑window coverage = 1.0 by design. See docs/VALIDATION.json for kev_rows_total_fetched, kev_rows_within_window, kev_rows_filtered_out, and kev_within_window_over_global_ratio.

Contents

• —parquet/: cve.parquet, nvd_meta.parquet, kev.parquet, edges.parquet, preview.parquet (~1000 CVEs; see preview criteria)
• —rag/ (optional): index.faiss, meta.parquet, mapping.parquet, vectors.npy
• —docs/: LICENSES.md, LICENCE.md (CC0 legal code), NOTICE.md, INTEGRITY.txt, VALIDATION.json, BUILD_MANIFEST.json
• —demo/: OVX_quickstart.ipynb, OVX_quickstart.html

RAG note

Optional RAG pack built from PD/CC0 text using BAAI/bge-small-en-v1.5 (384‑dim), normalized vectors with inner product (cosine) similarity. Retrieval is offline-only; query embedding requires the model to be already cached locally.

Preview parquet

• —parquet/preview.parquet is a convenience subset for quick inspection.
• —Selection: first 1000 rows by cve_id ordering from parquet/cve.parquet.
• —Columns: cve_id, summary, published_date, modified_date (when available); falls back to a best‑effort subset if needed.

Validation, integrity, build metadata

• —docs/VALIDATION.json includes: counts, cvss_v3_presence_ratio, cwe_presence_ratio, kev_cve_coverage_ratio, kev_cve_coverage_ratio_within_window, kev_rows_total_fetched, kev_rows_within_window, kev_within_window_over_global_ratio, rejected_cve_count, url_shape_failures, http_head_failures_hard, http_head_failures_flaky, dead_reference_links, duplicate_edges_dropped, snapshot_as_of.
• —URL checks (if present) were executed conservatively with a single worker.
• —Verify integrity locally:
• —macOS: shasum -a 256 -c docs/INTEGRITY.txt
• —Linux: sha256sum -c docs/INTEGRITY.txt
• —Build metadata (transparency): see docs/BUILD_MANIFEST.json for snapshot parameters (timestamp, NVD window, tool/version info, internal commit/config). Provided for transparency; the build system is not included.

Storage and performance

• —Parquet compression: snappy.
• —Disk footprint varies by window size; see file sizes before downloading.

Limitations

• —Some CVEs may lack CVSS vectors/scores within the window (nulls are expected).
• —URL checks are conservative and may still include dead/redirected links; verify with official sources.
• —KEV rows are filtered to the NVD window; counts reflect in‑window coverage, not global totals.

Usage

• —DuckDB

SELECT c.cve_id, m.cvss_v3_score, k.date_added
FROM read_parquet('parquet/kev.parquet') k
JOIN read_parquet('parquet/cve.parquet') c USING (cve_id)
LEFT JOIN read_parquet('parquet/nvd_meta.parquet') m USING (cve_id)
ORDER BY (m.cvss_v3_score IS NULL) ASC, m.cvss_v3_score DESC, k.date_added DESC
LIMIT 20;

• —Python (Pandas)

import pandas as pd
k = pd.read_parquet('parquet/kev.parquet')
c = pd.read_parquet('parquet/cve.parquet')
m = pd.read_parquet('parquet/nvd_meta.parquet')
df = k.merge(c, on='cve_id').merge(m[['cve_id','cvss_v3_score']], on='cve_id', how='left')
print(df.head())

• —Python (Polars)

import polars as pl
k = pl.read_parquet('parquet/kev.parquet')
c = pl.read_parquet('parquet/cve.parquet')
m = pl.read_parquet('parquet/nvd_meta.parquet').select('cve_id','cvss_v3_score')
df = k.join(c, on='cve_id').join(m, on='cve_id', how='left')
print(df.head())

Non-affiliation and licensing

• —Not affiliated with NIST/NVD, CISA/KEV, or FIRST/EPSS.
• —NVD non-endorsement: "This product uses data from the NVD API but is not endorsed or certified by the NVD."
• —Compiled artifact dedicated to the public domain under CC0 1.0 (see docs/LICENCE.md).
• —Upstream sources: NVD (public domain), CISA KEV (CC0). Linked third‑party pages (vendor advisories, blogs, etc.) are governed by their own terms.

Citation

If you use this snapshot, please cite:

"CVE-KEV Snapshot (${snapshot_as_of})", CC0-1.0, https://huggingface.co/datasets/NostromoHub/cve-kev-snapshot-90d-2025-09-04