Vulnerability Explorer (vex)

A git-native, interactive terminal reference and structured knowledge base for software vulnerabilities.

Imagine man pages built specifically for application security. Vulnerability Explorer is a curated, structured knowledge base of software vulnerabilities combined with a versatile command-line tool (vex).

❯ vex list

                                     Catalog Entries
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┓
┃ ID                                  ┃ Type          ┃ Title                  ┃ Langs  ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━┩
│ injection.sql-injection             │ concept       │ SQL Injection          │ -      │
│ injection.sql.inband.go-database... │ manifestation │ Classic In-Band SQLi...│ go     │
│ injection.sql.inband.java-jdbc...   │ manifestation │ Classic In-Band SQLi...│ java   │
│ injection.sql.inband.php-mysqli...  │ manifestation │ Classic In-Band SQLi...│ php    │
│ injection.sql.inband.python-psyc... │ manifestation │ Classic In-Band SQLi...│ python │
└─────────────────────────────────────┴───────────────┴────────────────────────┴────────┘

Why Vulnerability Explorer?

Traditional vulnerability databases (like CVEs or the NVD) focus on tracking patches for specific software versions. Vulnerability Explorer focuses on the code.

Every entry in our catalog is an atomic Markdown file enriched with strict YAML frontmatter. We document concrete vulnerability mechanisms (manifestations) across specific languages, frameworks, and architectures:

• White-box identification: Side-by-side vulnerable vs. safe code snippets and taint patterns.
• Gray/Black-box behavior: Observable indicators, error disclosures, and exploitation methodologies.
• Remediation: Primary fixes, strict allowlisting, and common mitigation mistakes.

Who is this for?

Quick Start

1. Installation

From PyPI

# Using pip
pip install vulnerability-explorer

# Or using uv (recommended)
uv pip install vulnerability-explorer

From Source (For Contributors)

git clone https://github.com/othonhugo/vulnerability-explorer.git
cd vulnerability-explorer

# Using pip
pip install -e .

# Using uv (recommended)
uv sync

2. Launch Interactive Mode

Simply type vex to launch the interactive arrow-key navigation menu:

vex

Features & CLI Usage

• Interactive Terminal CLI (vex): Built-in arrow-key interactive menu for seamless browsing.
• Rich Formatting & Pager: Read syntax-highlighted documentation right in your terminal (less-style scrolling).
• Multi-dimensional Filtering: Slice the catalog by language, category, or analysis mode.
• Full-Text Search: Instantly query across titles, tags, code snippets, and methodologies.

For full CLI options, flags, and advanced usage, see the CLI Commands Reference.

Developer & Contributor Tools

The catalog is logically organized under data/catalog/ and relies on a strict schema. We provide built-in tooling to ensure the knowledge base remains pristine.

# Run catalog integrity linter (validates YAML schema, internal links, and markdown structure)
vex-lint --root .

# Run Python code linters (Ruff & Mypy)
make lint-py

# Format Markdown/YAML (Prettier) and Python (Ruff)
make format

See CONTRIBUTING.md and our docs/contributing/ hierarchy for detailed entry guidelines.

Non-Goals

This repository does not contain weaponized exploits or automated scanning engines. Entries document recognition signals, root causes, and exploitation methodologies strictly necessary to understand, confirm, and fix vulnerabilities responsibly. See our ethical boundary guidelines for more details.