Return the current date and time in UTC. Call this first: "latest" and "recent" are relative to this date, not to your training data.

Search for CVEs published in the last N days (or since a date), enriched with EPSS exploit probability, CISA KEV membership and a risk score (patch priority).

Args: sort_by: "published" (newest first) or "risk" (highest patch priority first, ranked over all matches). Use "risk" for "what should I patch first", "most dangerous", "top N". reference_urls: Only with source="cvelist": match parts of reference links, OR-ed with keywords/cpes. A product's security advisory page finds CVEs filed under libraries it bundles, e.g. ["nodejs.org/en/blog/vulnerability"] finds a Brotli or OpenSSL CVE that Node.js lists. Use it together with keywords for a product. source: "nvd" (default; NVD API, any date range, CPE filters cover NVD-analyzed CVEs) or "cvelist" (CVEProject CVE List: last 30 days only, no rate limit, CVEs appear about an hour before NVD, includes vendor-supplied affected versions; keywords also match vendor and product names; CPE filters only match where the vendor supplied CPEs). Use "cvelist" for the last hours or days, or when NVD is unavailable or slow. days: Look-back window in days. Use small windows (1-7) for "latest". Ignored when since is set. keywords: Optional free-text filters, OR-ed (one search each), e.g. ["openssl"] or ["node.js", "curl"]. Matches anywhere in the description, so it is broad. since: Optional start date YYYY-MM-DD for historical questions ("since 2020"). Ranges over 120 days require keywords or cpes. cpes: Optional exact products as CPE names, OR-ed: "vendor:product" for applications, "o:vendor:product" for operating systems, e.g. ["nodejs:node.js", "haxx:curl", "o:linux:linux_kernel"]. Use find_cpe_name if unsure. More precise than keywords but only covers CVEs NVD has already analyzed. min_severity: Optional minimum CVSS severity. limit: Maximum number of CVEs to return (1-100). min_score: Optional minimum CVSS base score (0-10), e.g. 8. rce_only: Only remote code execution (code/command injection reachable over the network; heuristic on CWE, description and CVSS vector). match_any: If true, keep items meeting ANY of min_severity/min_score/rce_only/poc_only instead of ALL of them. poc_only: Only items with a public exploit: a PoC repository on GitHub (listed in github_pocs, from nomi-sec/PoC-in-GitHub), a CISA SSVC or CVSS v4 rating of a public PoC (ignored when the CVE links a bug bounty report such as HackerOne), or exploitation in the wild (CISA KEV). A reference NVD tagged "Exploit" alone does not count.

Search the GitHub Advisory Database for security advisories published in the last N days, newest first. Best source for open-source dependencies: each reviewed advisory names the package, vulnerable version range and first patched version. Some advisories have no CVE ID (only a GHSA ID).

Args: days: Look-back window in days. ecosystem: Optional package ecosystem filter (pip = Python, npm = JavaScript, maven = Java, rust = crates.io, ...). package: Optional package name, e.g. "lodash" or "django". min_severity: Optional minimum severity. include_unreviewed: Also include advisories not yet reviewed by GitHub (usually NVD mirrors without package data). limit: Maximum number of advisories to return (1-100). min_score: Optional minimum CVSS base score (0-10), e.g. 8. rce_only: Only remote code execution (code/command injection reachable over the network; heuristic on CWE, description and CVSS vector). match_any: If true, keep items meeting ANY of min_severity/min_score/rce_only/poc_only instead of ALL of them. poc_only: Only items with a public exploit: a PoC repository on GitHub (listed in github_pocs, from nomi-sec/PoC-in-GitHub), a CISA SSVC or CVSS v4 rating of a public PoC (ignored when the CVE links a bug bounty report such as HackerOne), or exploitation in the wild (CISA KEV). A reference NVD tagged "Exploit" alone does not count. sort_by: "published" (newest first) or "risk" (highest patch priority first, over the newest 100 advisories).

Look up the exact NVD CPE name ("vendor:product", or "o:vendor:product" for operating systems) for a product, to pass in search_recent_cves(cpes=...). Products whose name matches best come first; deprecated names show their replacement.

Args: product: Product name, e.g. "curl", "node.js", "apache http server", "linux kernel".

Fetch full, current details of one CVE from the NVD, with the vendor's affected versions from the CVE List, EPSS, CISA KEV status and any GitHub advisories (affected packages and patched versions). Falls back to the CVE List when NVD is unavailable or does not have the CVE yet.

Args: cve_id: CVE identifier, e.g. "CVE-2026-12345".

List vulnerabilities CISA added to its Known Exploited Vulnerabilities (KEV) catalog in the last N days - CVEs confirmed exploited in the wild. Note: an old CVE can be newly added here; report its date_added.

Args: days: Look-back window in days. limit: Maximum number of entries to return.