In node, I can run npm audit
and it will show me known vulnerabilities for the versions my dependencies are using.
That's cool and all, but I'd like to be able to do the following, on some website or program or anything else:
Enter an npm package/python module/other software... and say I've gone from version X to version Y. And then get an output saying:
- CVEs fixed by upgrading
- CVEs introduced by upgrading
- CVEs that remain unfixed for this version
Along with the dates at which the CVE was discovered/fixed and maybe other useful info.
Is that a thing that exists somewhere? Or could I throw together a script and query cve.mitre or some other website? Are there services that provide this?