cve-watchlist-action-recommendation-generator

# CVE Watchlist & Action Recommendation Generator Generate prioritized CVE watchlists with actionable security recommendations for development and security teams. ## Workflow ### 1. Gather Input Data Collect required inputs: **Required:** - Repository name/path - CVE scan results (JSON/SARIF format from npm audit, pip-audit, Snyk, etc.) - Cutoff date (YYYY-MM-DD) for filtering new CVEs **Optional but recommended:** - Reachability analysis results (which vulnerable code paths are actually used) - Exploit intelligence data (CISA KEV, ExploitDB) - Dependency criticality ratings (how critical each dependency is) **Parse scan results:** ```bash python scripts/parse_scan_results.py scan_results.json auto 2024-01-01 > parsed_cves.json ``` ### 2. Calculate Risk Scores Combine multiple risk factors to prioritize CVEs: ```bash python scripts/calculate_risk_score.py parsed_cves.json reachability.json exploits.json criticality.json > scored_cves.json ``` **Risk scoring formula:** ``` Risk Score = (Severity × 0.35) + (Reachability × 0.30) + (Exploitability × 0.20) + (Dependency Criticality × 0.15) ``` See [risk_scoring.md](references/risk_scoring.md) for detailed methodology. ### 3. Generate Recommendations For each CVE, determine appropriate action based on risk score and context: **Decision tree:** - Risk ≥ 80 (Critical) → Immediate upgrade (24-48h) - Risk 60-79 (High) → Upgrade within days (3-5 days) - Risk 40-59 (Medium) → Next maintenance cycle (2-4 weeks) - Risk 20-39...