DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to look up CVEs and known issues for a tech stack with Blitzstrike

Query NVD and the tech correlation data to see which known issues match a product or version you run.

Authorization notice. Blitzstrike is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forA developer or operator who needs to know whether a technology in use has known CVEs before patching.

The problemChecking each product and CVE by hand across several sources takes time and is easy to skip.

The outcomeA list of CVE details from NVD and the known vulnerabilities linked to a technology, to guide patch priority.

What you need first

  • Node.js (for npx) or Bun, plus an MCP-compatible agent such as Claude Code, Cursor, Codex, or Gemini CLI
  • For source audits: a local source tree you are allowed to scan
  • For live tests: written authorization for the target and a defined scope
  • Optional: FOFA_EMAIL and FOFA_KEY if you want FOFA asset search

Steps

  1. Run npx -y blitzstrike install to register the MCP server with your agent.
  2. Ask the agent to call nvd_lookup with a CVE ID you want to check, which needs no API key.
  3. Ask the agent to call tech_correlation with the technology name from your stack.
  4. Ask the agent to call cve_correlation for any CVE that appears in the results.
  5. Record the CVEs that match your versions and decide which to patch first.

Prompt for your agent

Using the blitzstrike MCP server, call nvd_lookup for <CVE ID> and tech_correlation for <technology name>. Return the matching CVEs with their severity and the related product. Verify that each listed CVE is confirmed against the version you run before you act on it.

Caveat. Correlation data is a starting point, so confirm each CVE against the exact product version you run in your environment.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page