Distributed Risk desk

Which of these package versions have a known vulnerability. Give packages directly (ecosystem, name, version), or paste a lockfile or SBOM as manifest and it is read for you: package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock, packages.lock.json, gradle.lockfile, cyclonedx, spdx, purls. Each version is checked against OSV.dev, which aggregates GitHub's reviewed advisories, the Go and PyPI databases, RustSec and OpenSSF's malicious-package reports across npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist and more. Every hit comes back with its severity, the CVEs it is known by, the versions that fix it, whether CISA lists it as exploited with the federal due date, and FIRST's EPSS estimate. Exploited packages come first, then malicious packages, then severity. A version with no hit is a version no advisory in those databases covers; that is not a statement that it is safe. Only resolved versions are read: a file of ranges (package.json, Pipfile, pom.xml) cannot be checked, so pass the lockfile beside it.

Everything the record says about one CVE, in one answer: the CVE.org record (description, severity, weakness, affected products, references), CISA's exploitation call (SSVC) and its KEV listing with the federal due date, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack.

One published note in full (Markdown), with its numbered sources and links to the official record.

The New York Fed's reference rates: EFFR and OBFR (unsecured), SOFR, BGCR and TGCR (secured), and the SOFR averages and index (SOFRAI). With no rate, the latest of each; with a rate, its last N days, with percentiles, volume and, for EFFR, the target range.

Treasury's daily par yield curve, newest first: yields by tenor from 1 month to 30 years. Ask for the last N days, and optionally only some tenors (for example ["2 Yr", "10 Yr"]).

New advisories against the software AI agents run on, newest and most severe first: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each with package, severity, fixed versions, CVEs, EPSS and the advisory.

CISA's advisories, newest first: alerts, joint cybersecurity advisories (#StopRansomware, state-sponsored activity), ICS and ICS-medical advisories, and analysis reports. Each with its kind, date, summary, the CVEs it names and the official page. Filter by kind, date, words, or the AI stack.

Cybersecurity incidents public companies report on Form 8-K, newest first: Item 1.05 (the company judged it material) and, unless excluded, Item 8.01 reports made without that judgment. Each with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing.

What is new across the three vulnerability feeds, exploited first, then by severity, then newest: GitHub's reviewed advisories (the affected package range and the first patched version), NVD's newly published CVE records (software no package ecosystem carries, with NIST's scoring), and the CVEs CISA added to its Known Exploited Vulnerabilities catalog. A KEV addition keeps its own date: it is CISA saying this one is being exploited now, often long after the CVE was published. A CVE that GitHub and NVD both published in the window appears once, from GitHub. For CISA's alerts and joint advisories rather than vulnerabilities, use list_cyber_advisories.

Published desk notes, newest first: entry number, date (the day of the official action), published (the day the desk published the note), title, status, topic (cyber or sanctions), readers, source class, a one-line summary, and the note's URL. Pages with limit and offset; total is the count that matches, next_offset the offset of the next page. Filter by topic or reader as on the desk page.

OFAC's recent actions, newest first: designations and removals, general licenses, FAQs, regulations and settlements, each with its date, categories and the official page. Filter by date or words in the title.

US State Department travel advisories, most recently updated first: country, level (1 to 4), the advisory's summary and the official page. Filter by country, minimum level or update date.

Search Federal Register rules, proposed rules, notices and presidential documents: title, type, agencies, publication and effective dates, citation, abstract and the official document link. Narrow by agency (for example foreign-assets-control-office, industry-and-security-bureau, state-department), type or date.

CISA's Known Exploited Vulnerabilities catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Look up one CVE, search vendor or product words, list what was added since a date, or only the AI stack. For one CVE in full, use get_cve.

Find published notes that mention every word of the query (a name, a list, a country, a program, a date) in the title, summary, sources or body.

Search the Consolidated Screening List (OFAC SDN and other Treasury lists; BIS Entity, Denied Persons, Unverified and Military End User lists; State ITAR-debarred and nonproliferation lists) by name, alias or identifier (IMO, SWIFT/BIC, registration number). Close spellings match. Each result gives the list, programs, addresses, IDs, remarks and the official list link; the answer says when each list last changed.