Kepler is a vulnerability database and lookup store and API currently utilising National Vulnerability Database as data sources; implementing CPE 2.3 tree expressions and version range evaluation in realtime.

We provide a docker bundle with kepler, dedicated PostgreSQL database and Ofelia as job scheduler for continuous update

docker compose build
docker compose up

When the application starts checks for pending database migrations and automatically applies them. Remove the --migrate option to stop when a pending migration is detected

Alternatively you can build kepler from sources. To build you need rust, cargo and libpg-dev (or equivalent PostgreSQL library for your Linux distribution)

cargo build --release

The system will automatically fetch and import new records every 3 hours if you use our bundle, while historical data must be imported manually.

Kepler currently supports two data sources, National Vulnerability Database and NPM Advisories. You can import the data sources historically as follows.

To import NIST records from all available years (2002 to 2022):

for year in $(seq 2002 2022); do 
    docker run --rm -v $(pwd)/data:/data \
        -e DATABASE_URL=postgres://kepler:kepler@localhost:5432/kepler \
	--network=kepler_default \
	kepler:dev import_nist $year -d /data; 
done 

The system will automatically fetch and import new records records every 3 hours.

There are two primary APIs as of right now — the product API and the cve API detailed below.

Products can be listed:

curl http://localhost:8000/products

Grouped by vendor:

curl http://localhost:8000/products/by_vendor

Or searched:

curl http://localhost:8000/products/search/iphone

To use the vulnerabilities search API via cURL (prepend node- to the product name in order to search for NPM specific packages):

curl \
    --header "Content-Type: application/json" \
    --request POST \
    --data '{"product":"libxml2","version":"2.9.10"}' \
    http://localhost:8000/cve/search

Responses are cached in memory with a LRU limit of 4096 elements.