Head of Research at Empirical Security and founder of RogoLabs: I take the CVE list apart and publish what I find.
I work on vulnerability data for a living at Empirical Security. Then I go home and keep working on it at RogoLabs, my open-source lab. Rogo is Latin for "I ask," which is most of the job. I also sit on the CVE Program's Quality, Automation and Consumer working groups.
| Tool | The question it answers | Code |
|---|---|---|
| CVE.ICU | What is in the CVE list right now? Rebuilt whenever a fresh NVD snapshot lands. | RogoLabs/cve.icu |
| CVEForecast | How many CVEs are coming next? | RogoLabs/CVEForecast |
| CVE Floodline | Is a jump in CVE volume rain or a flood? Uses EPSS and CISA KEV to tell them apart. | RogoLabs/cvefloodline.org |
| RBP Tracker | Which CVE IDs are cited in public advisories but still sit in Reserved? | RogoLabs/RBP |
| CNA Scorecard | How complete, accurate and timely is each CNA's data? | RogoLabs/CNAScoreCard |
| CNAPulse | Which CNAs are publishing more, or less, than their own baseline? | RogoLabs/CNAPulse |
| PatchThis.app | What should you patch first, ranked by exploitability instead of CVSS? | RogoLabs/patchthisapp |
| VulnRadar | Which new CVEs touch your stack? A watchlist that files GitHub issues. | RogoLabs/VulnRadar |
Talk slides and recordings live on rogolabs.net. Data reviews and build logs live on jerrygamblin.com.
Every number on these sites comes from a public feed and a script you can read. If one looks wrong, open an issue on that repo and show me. I would rather be corrected than believed.