--- title: "CVE Risk Check on ChatGPT: ranks and changes · OpenApps" description: "On Oct 29, 2026, CVE Risk Check is an app on ChatGPT by Agent Tools, ranked #60 in Security." url: https://theopenapps.com/chatgpt/apps/cve-risk-check --- > AI agents: this is one page of OpenApps as Markdown. https://theopenapps.com/llms.txt maps the site, the API and the MCP server. # CVE Risk Check [Agent Tools](https://theopenapps.com/publishers/agenttools) Security ChatGPT Apps SDK New [AppSec & vulnerabilities](https://theopenapps.com/tags/appsec) [Developers](https://theopenapps.com/tags/for-developers) Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version). Ask "how bad is CVE-2021-44228?", "which of these CVEs should I patch first?", "what did CISA add to its exploited list this month?" or "which dependencies in this package-lock.json should I fix first?". CVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CISA Known Exploited Vulnerabilities (KEV) catalog lists the CVE, with CISA's due date and required action. FIRST's EPSS gives the modelled probability that the CVE is exploited in the next 30 days. Each CVE gets a priority: "exploited" when CISA lists it, "likely" when its EPSS score is 0.1 or more, otherwise "routine", or "unknown" when EPSS could not be read. A batch of up to 10 CVEs comes back sorted with the most urgent first. Every answer names its sources and the date the NVD record and the EPSS score are from. NVD limits requests without a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry. For a dependency list, pass the text of a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock, go.sum or go.mod), a package.json or a requirements.txt, or a list of packages with exact versions (npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet or Packagist). Each package version is matched to its known advisories in OSV.dev, which collects the GitHub Advisory Database and other open databases. The advisories' CVE ids are then checked against the CISA exploited list and EPSS. The answer is the few packages to fix first, each with a priority (malicious, exploited, likely, routine or unknown), a one-line reason and the version to upgrade to, followed by a short list of the rest. A match is by exact name and version: it does not show that your code reaches the vulnerable code. It does not scan your systems, read your source code, confirm that you are vulnerable, or tell you how to exploit anything. The CVE ids and dependency lists you send are not stored; the only lasting record is a daily count of calls per tool. [Open in ChatGPT](https://chatgpt.com/plugins/plugin%5Fasdk%5Fapp%5F6ac270bba9b48191a54808e45417444b?open%5Fin%5Fapp) [Website](https://tools.openkrill.app/) [Top rank now #60 1 up · 1d Security](https://theopenapps.com/chatgpt/apps/cve-risk-check?tab=ranks&slug=category%3Asecurity) [Peak (14d) #60 Security](https://theopenapps.com/chatgpt/apps/cve-risk-check?tab=ranks&slug=category%3Asecurity) First listed Oct 28, 2026 [Overview](https://theopenapps.com/chatgpt/apps/cve-risk-check) [Ranks](https://theopenapps.com/chatgpt/apps/cve-risk-check?tab=ranks) [Changes](https://theopenapps.com/chatgpt/apps/cve-risk-check?tab=changes) ## Where it stands [Security #60 1 up · 1d NEW to the chart Peak #60 in 14d](https://theopenapps.com/chatgpt/apps/cve-risk-check?tab=ranks&slug=category%3Asecurity) ## Starter prompts * How bad is CVE-2021-44228? * Which of CVE-2023-4863, CVE-2024-3094 and CVE-2019-0708 should I patch first? * Which dependencies in my package-lock.json should I fix first? ## Details Developer [Agent Tools](https://theopenapps.com/publishers/agenttools) Category Security Kind Apps SDK Version 1.2.0 Sign-in On install Capabilities Looks up a CVE's description, CVSS score and severity, and publication date from the NVD, Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action, Adds the EPSS score: the modelled chance of exploitation in the next 30 days, Gives each CVE a priority: exploited, likely or routine, Ranks a batch of up to 10 CVEs with the most urgent first, Reads an npm, pnpm, yarn, Poetry, uv, Cargo or Go lockfile and names the 3 packages to upgrade first, with the fix, Matches package versions to OSV.dev advisories in 8 ecosystems, including npm, PyPI, Go, Maven and crates.io, Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word, Links a patch or vendor advisory when NVD tags one, and names its sources and dates Created Oct 4 Website [tools.openkrill.app](https://tools.openkrill.app/) Privacy [tools.openkrill.app](https://tools.openkrill.app/privacy) Listing ID plugin\_asdk\_app\_6ac270bba9b48191a54808e45417444b ## Launch lag 24 d Oct 4 → Oct 28 ## Badge ```markdown [![Listed on OpenApps](https://theopenapps.com/badge/chatgpt/apps/cve-risk-check.svg)](https://theopenapps.com/chatgpt/apps/cve-risk-check) ```