CVE Search

A bar widget for Omarchy that answers the question you usually open three browser tabs for: is there a public exploit for this thing, and what is the bug actually about?

Click CVE in the bar, type a CVE ID or a product name, press Enter. The widget searches the ExploitDB copy already on your disk, then pulls the vulnerability description from CIRCL and gives you the links to read further.

How it works

Two very different things happen behind one search box, and the panel treats them differently on purpose.

The exploit search is local. searchsploit reads the ExploitDB mirror that ships with the exploitdb package, so it answers in well under a second and works with the network down. A CVE ID is looked up with searchsploit --cve; anything else is treated as a product search, where each word narrows the match (apache struts finds entries containing both).

The descriptions come from the network. ExploitDB knows exploit titles, not what a vulnerability does, so every CVE ID the search turned up is looked up against the CIRCL CVE API — a free, key-less mirror of the official CVE records. Those lookups are slower and occasionally fail, so they run after the exploit list is already on screen and fill in one by one. You never wait on the network to see what ExploitDB has.

A search by CVE ID always gets a description card, even when no exploit matches — "nobody has published an exploit for this" is usually the answer you were after.

Requirements

Package	Why	Install
exploitdb	the local ExploitDB mirror and searchsploit	omarchy pkg add exploitdb
jq	the helper builds its JSON with it	usually already present
curl	CVE description lookups	usually already present
wl-clipboard	the copy-path button (optional)	omarchy pkg add wl-clipboard

exploitdb is about 170 MB installed — it is the entire exploit archive, not an index.

Install

One command:

omarchy plugin add https://github.com/hed1ad/CVE-Omarchy-Plugin.git --enable
omarchy restart shell

plugin add clones the repo, validates the manifest, installs it as ~/.config/omarchy/plugins/hed1ad.cve-search (the directory is named after the manifest id), and asks which bar section to put it in — right, by default. The restart is only needed for that first install; freshly added QML is not always picked up by the hot-reloader. After that, saving a file in the plugin directory reloads it on its own.

Later, omarchy plugin update hed1ad.cve-search pulls new commits and omarchy plugin remove hed1ad.cve-search takes it off.

To install by hand instead, clone into the plugins directory yourself and add the widget to the bar:

git clone https://github.com/hed1ad/CVE-Omarchy-Plugin.git ~/.config/omarchy/plugins/hed1ad.cve-search
omarchy bar put hed1ad.cve-search --section right --index 0
omarchy restart shell

Either way the directory name has to match the id in manifest.json. To namespace it under your own handle, rename all of them together: the directory, and id / moduleName / ipcTarget in manifest.json and Panel.qml.

Using it

Click CVE in the bar (or drive it over IPC, below). The search field takes focus straight away, so you can type immediately.

• A CVE ID — CVE-2021-44228 — gives you the description, whether a public exploit exists, and the exploits themselves if there are any.
• A product name — log4j, apache struts, sudo — lists what ExploitDB has, with descriptions for the CVEs those exploits reference.

In the results:

• EXPLOIT AVAILABLE / NO PUBLIC EXPLOIT is a statement about ExploitDB only. It is not a claim about the wider world — see the limits below.
• Read on NVD opens the full record at nvd.nist.gov in your browser.
• Clicking an exploit row opens its page on exploit-db.com.
• The copy button on a row copies the local file path of the exploit (something like /usr/share/exploitdb/exploits/java/remote/50592.py) so you can open the actual code without downloading anything.

Esc closes the panel. Tab moves to the neighbouring bar panel, as elsewhere in Omarchy.

Settings

One knob, in the widget's entry in ~/.config/omarchy/shell.json:

omarchy bar set hed1ad.cve-search maxExploits 30

maxExploits (default 15) caps how many exploit rows are drawn. A broad product name can match hundreds; the count in the section header is always the true total, and the panel tells you how many it left out.

The number of CVEs described per search is capped at 5 in the helper (MAX_CVE_LOOKUPS), because each one is a separate network request.

Driving it from elsewhere

The widget exposes IPC, which is handy for a keybinding or a script:

omarchy-shell hed1ad.cve-search toggle
omarchy-shell hed1ad.cve-search open
omarchy-shell hed1ad.cve-search close
omarchy-shell hed1ad.cve-search query "CVE-2021-44228"   # opens and searches

To put it on a key, add this to ~/.config/hypr/bindings.lua:

o.bind("SUPER + SHIFT + V", "CVE search", "omarchy-shell hed1ad.cve-search toggle")

The backend is a plain script and works on its own, if you want the JSON for something else:

~/.config/omarchy/plugins/hed1ad.cve-search/omarchy-cve-search-fetch "log4j"
~/.config/omarchy/plugins/hed1ad.cve-search/omarchy-cve-search-fetch --describe CVE-2021-44228

Keeping the database fresh

The exploit archive is a package, so it updates with the system:

omarchy update          # or: sudo pacman -Syu exploitdb

searchsploit -u also works, but on Arch it fights with pacman's copy of the files. Prefer the package.

What it can and cannot tell you

Worth being clear about, because a security tool that overstates itself is worse than no tool.

• "No public exploit" means "not in ExploitDB." Metasploit modules, GitHub PoCs, exploits in private collections and everything unpublished are outside what this searches.
• Exploit-to-CVE mapping is patchy. ExploitDB's Codes field is filled in by hand, so plenty of older entries reference no CVE at all. You will see exploits listed with no description card to go with them; that is the data, not a bug.
• A product-name search matches exploit titles, not versions. An entry for "sudo 1.6.0" shows up whatever version you are running. It tells you what exists, not whether you are affected.
• CIRCL is a public service and occasionally hiccups. The helper retries once; if it still fails, the card says the description is unavailable and the NVD link still works.

Use it to orient yourself quickly, then confirm with the real record.

Privacy

The exploit search never leaves your machine. The only outbound requests are the CVE description lookups, which send a CVE ID — nothing else — to cve.circl.lu. Opening a link launches your normal browser, which on Omarchy means a private window.

Troubleshooting

The widget is not in the bar. Check it is listed: jq '.bar.layout' ~/.config/omarchy/shell.json, then omarchy restart shell.

Edits do not take effect. Saving inside the plugin directory normally hot-reloads it. If a change is ignored, omarchy-shell shell rescanPlugins, and failing that omarchy restart shell — a first-time load of new QML sometimes needs the full restart.

Errors. The shell logs everything:

journalctl --user --since "5 minutes ago" | grep -i cve-search

"searchsploit not found" in the panel means the package is missing: omarchy pkg add exploitdb.

Files

manifest.json              widget metadata, defaults, and settings schema
Panel.qml                  the bar button and the popup
Service.qml                runs the helper, holds the results
omarchy-cve-search-fetch   the backend: searchsploit + CIRCL, emits JSON
logo.svg, preview.png      what you are looking at

Contributing

Bug reports and patches are welcome — CONTRIBUTING.md explains how the pieces fit together and what to check before opening a PR.

License

MIT.

Exploit data comes from Exploit-DB (OffSec), CVE records from CIRCL and NVD; each carries its own terms.