# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).

## [0.2.0] — 2026-06-29

### Added
- **Shodan CVEDB** — `shodan_cve`, `shodan_product`, `shodan_ip_vulns` (zero-auth CVE + IP vulnerability lookup)
- **VulnCheck** — `vulncheck_kev`, `vulncheck_cpe`, `vulncheck_purl` (extended KEV, CPE/PURL search)
- **Vulners** — `vulners_lookup`, `vulners_search` (200+ vulnerability sources)
- **Nuclei Templates** — `nuclei_check` (detect if CVE has a Nuclei detection template)
- **Metasploit** — `msf_check` (detect if CVE has a Metasploit exploit module)
- **NVD CPE** — `cpe_search`, `cpe_match` (CPE dictionary search, CVE-to-CPE mapping)
- **CIRCL** — `circl_cve` (CAPEC mapping, alternative references, impact vectors)
- **AttackerKB** — `attackerkb_assess` (community attacker value + exploitability ratings)
- **ATT&CK** — `cve_to_attack` (CWE-to-MITRE ATT&CK technique mapping)
- **CWE API** — `cwe_get`, `cwe_hierarchy`, `cwe_top25` (full MITRE CWE REST API, 1000+ CWEs)
- CVSS v4.0 support in `cvss_parse` (auto-detects v3.1 vs v4.0, MacroVector scoring)
- Exploit multiplier in risk score (1.5x when Nuclei/MSF module exists)
- Weaponization detection in `cve_enrich` (Shodan + Nuclei + Metasploit signals)
- 11 data source health checks in `cve_list_sources`
- MSF module metadata cache (loaded once, 1hr TTL, indexed by CVE)

### Changed
- Tool count: 23 → 41
- Data sources: 5 → 11 (+ Shodan, VulnCheck, Vulners, Nuclei, Metasploit, CIRCL, AttackerKB, ATT&CK, CWE API)
- `cve_enrich` now queries 8 sources in parallel (was 5)
- Risk formula: `CVSS × EPSS × KEV × Exploit` (was `CVSS × EPSS × KEV`)
- CWE module: API-first with static fallback (was static-only)
- CVSS parser: v3.1 + v4.0 (was v3.1 only)

### Environment Variables
- `VULNCHECK_API_KEY` — Optional. VulnCheck extended KEV, CPE, PURL search
- `VULNERS_API_KEY` — Optional. Vulners vulnerability search across 200+ sources
- `ATTACKERKB_API_KEY` — Optional. AttackerKB community assessments

## [0.1.0] — 2025-03-15

### Added
- Initial release with 23 tools across 5 data sources
- NVD API v2 integration (search, get, recent, product search)
- EPSS exploitation probability scores
- CISA KEV catalog checking and search
- GitHub Advisory Database search
- OSV vulnerability queries (single + batch)
- Exploit PoC search via GitHub repositories
- CWE weakness lookup (40+ embedded entries)
- CVSS v3.1 vector parser with full score calculation
- Meta tools: enrich, prioritize, trending, compare, report
- Rate limiter for NVD API compliance
- TTL cache for NVD results and KEV catalog
- CLI with --help, --list, --tool support