{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "shinthink-blitzstrike--look-up-cves-for-a-stack",
 "repo": "shinthink/blitzstrike",
 "repo_url": "https://github.com/shinthink/blitzstrike",
 "repo_slug": "shinthink-blitzstrike",
 "title": "Look up CVEs and known issues for a tech stack",
 "page_title": "How to look up CVEs and known issues for a tech stack with Blitzstrike",
 "summary": "Query NVD and the tech correlation data to see which known issues match a product or version you run.",
 "who": "A developer or operator who needs to know whether a technology in use has known CVEs before patching.",
 "problem": "Checking each product and CVE by hand across several sources takes time and is easy to skip.",
 "outcome": "A list of CVE details from NVD and the known vulnerabilities linked to a technology, to guide patch priority.",
 "steps": [
  "Run `npx -y blitzstrike install` to register the MCP server with your agent.",
  "Ask the agent to call nvd_lookup with a CVE ID you want to check, which needs no API key.",
  "Ask the agent to call tech_correlation with the technology name from your stack.",
  "Ask the agent to call cve_correlation for any CVE that appears in the results.",
  "Record the CVEs that match your versions and decide which to patch first."
 ],
 "agent_prompt": "Using the blitzstrike MCP server, call nvd_lookup for <CVE ID> and tech_correlation for <technology name>. Return the matching CVEs with their severity and the related product. Verify that each listed CVE is confirmed against the version you run before you act on it.",
 "agents": [
  "claude-code",
  "cursor",
  "codex",
  "gemini-cli"
 ],
 "difficulty": "Intermediate",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "Correlation data is a starting point, so confirm each CVE against the exact product version you run in your environment.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "typescript",
 "requirements": [
  "Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI",
  "For source audits: a local source tree you are allowed to scan",
  "For live tests: written authorization for the target and a defined scope",
  "Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.7,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/shinthink-blitzstrike/look-up-cves-for-a-stack/",
 "md": "https://dedupedai.com/use-cases/shinthink-blitzstrike/look-up-cves-for-a-stack/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/shinthink-blitzstrike--look-up-cves-for-a-stack.json",
 "api_version": "v1"
}