How to Install and Use cvemap in Linux to Query and Prioritize Vulnerability Intelligence

In modern vulnerability management, security teams face thousands of newly disclosed Common Vulnerabilities and Exposures (CVEs) every year. Reviewing sprawling National Vulnerability Database (NVD) entries, cross-referencing CVSS severity ratings, and manually determining whether an exploit is actively weaponized in the wild is time-consuming. Modern vulnerability prioritization requires analyzing multiple real-world risk metrics, including the Exploit Prediction Scoring System (EPSS), CISA Known Exploited Vulnerabilities (KEV) catalog listings, and GitHub public proof-of-concept availability. cvemap, developed by ProjectDiscovery, is a specialized command-line utility built to query and prioritize vulnerability intelligence directly from the terminal.

Written in Go, cvemap aggregates data from multiple security intelligence databases, allowing system administrators and security engineers to filter, search, and prioritize CVEs with granular command-line arguments.

Why Traditional CVSS Ratings are Insufficient

Relying exclusively on CVSS scores often leads to alert fatigue and misdirected patching efforts:

• CVSS Measures Theoretical Severity: A CVSS 9.8 score indicates severe potential impact, but if no exploit exists and the vulnerable service is never exposed, real-world risk is low.
• EPSS Measures Real-World Probability: The Exploit Prediction Scoring System estimates the probability (0.0 to 1.0) that a CVE will be exploited in the wild within 30 days.
• CISA KEV Confirms Active Exploitation: The Cybersecurity and Infrastructure Security Agency maintains a strict catalog of vulnerabilities actively weaponized by threat actors.
• cvemap Consolidates All Metrics: Correlates CVSS, EPSS, KEV, vendor advisories, and public exploit code into a single, structured terminal view.

Installing cvemap on Linux

You can install cvemap via official pre-compiled binaries or by compiling with the Go toolchain:

# Method 1: Download Official Pre-compiled Binary (Recommended)
curl -s https://api.github.com/repos/projectdiscovery/cvemap/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf cvemap_*_linux_amd64.tar.gz
sudo mv cvemap /usr/local/bin/
cvemap -version

# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/cvemap/cmd/cvemap@latest

Configuring the ProjectDiscovery API Token

To query the ProjectDiscovery Cloud Vulnerability API, configure a free API key:

export PDCP_API_KEY="your_api_token"

Add this export line to your ~/.bashrc or ~/.zshrc file for persistence across terminal sessions.

Essential Command Flags and Query Filters

The table below summarizes common command-line options in cvemap:

Flag	Functionality	Usage Example
-id <CVE-ID>	Query a specific CVE identifier	cvemap -id CVE-2023-38606
-product <name>	Filter CVEs affecting a specific product	cvemap -product "nginx"
-vendor <name>	Filter CVEs affecting a specific software vendor	cvemap -vendor "microsoft"
-severity <level>	Filter by severity (critical, high, medium, low)	cvemap -severity critical
-kev	Filter only vulnerabilities in CISA KEV catalog	cvemap -product "fortios" -kev
-epss-score >= <n>	Filter by minimum EPSS probability threshold	cvemap -epss-score ">= 0.5"
-json	Output detailed JSON objects for CI/CD scripting	cvemap -id CVE-2021-44228 -json

Practical Vulnerability Prioritization Workflows

1. Inspecting a Single CVE

Query comprehensive metrics for a specific vulnerability:

cvemap -id CVE-2023-34362

Output details include the CVSS score, EPSS probability, CISA KEV due date, CWE categorization, and links to public GitHub PoC exploit repositories.

2. Filtering for Actively Weaponized Vulnerabilities

When triaging patch queues for enterprise infrastructure, prioritize vulnerabilities affecting your software stack that are confirmed to be exploited in the wild:

cvemap -product "confluence_data_center_and_server" -kev

3. Exporting High-Risk CVEs to JSON for Automated Alerting

Export all critical vulnerabilities with an EPSS score greater than 80% to feed into automated Slack or Jira ticketing pipelines:

cvemap -severity critical -epss-score ">= 0.8" -json -o urgent_cves.json

Frequently Asked Questions

Where does cvemap source its public exploit availability data?

cvemap tracks real-time threat feeds, Metasploit modules, Exploit-DB, and monitored GitHub repositories to identify publicly accessible proof-of-concept exploits.

Can cvemap scan my local Linux server packages for vulnerabilities?

No. cvemap is a vulnerability intelligence lookup and filtering tool. To scan installed system packages on disk, pair it with scanners like trivy or syft.