Low Severity
Published: Nov 12, 2026
Free tools for writing security reports: find a CWE, look up CVEs and GHSAs, score CVSS 3.1/4.0, check EPSS and KEV, build version ranges, get PURLs and find a CNA
<h1 align="center">Security Reporting Toolbox</h1>
<p align="center">
<i>The fiddly bits of writing a security report, in one place</i>
<br />
<b>🌐 <a href="https://security-reporting-toolbox.peng.ly/">security-reporting-toolbox.peng.ly</a></b><br />
</p>
<details>
<summary>Contents</summary>
- [About](#about)
- [Usage](#usage)
- [Deployment](#deployment)
- [Development](#development)
- [Credits](#credits)
</details>
## About
Writing up a vulnerability means a dozen small side quests - which CWE, what's the CVSS score, is it in KEV, what's the exact package name, how do I write "everything before 2.4.1" so GitHub understands it, and who do I even ask for a CVE. This puts all of those in one place, with each tool talking straight to the official source.
| Tool | What it does | Source |
| ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------------- |
| [CWE explorer](https://security-reporting-toolbox.peng.ly/cwe) | Find the right weakness, with MITRE's mapping guidance, plus Top 25 and OWASP views | MITRE CWE |
| [CVE lookup](https://security-reporting-toolbox.peng.ly/cve) | CVEs and GHSAs side by side from every source, with aliases cross-referenced | CVE.org, NVD, GitHub, OSV |
| [CVSS calculator](https://security-reporting-toolbox.peng.ly/cvss) | Score 3.1 and 4.0, decode and check vectors, rough conversion between them | FIRST |
| [EPSS lookup](https://security-reporting-toolbox.peng.ly/epss) | Exploit probability and percentile for a whole list of CVEs, with history | FIRST EPSS |
| [KEV checker](https://security-reporting-toolbox.peng.ly/kev)