⚡ Ch4120N CVE Pulse

Live CVE PoC Aggregator with Smart Search & Threat Intelligence

CVE Pulse automatically discovers, scores, and indexes CVE Proof‑of‑Concepts from GitHub.
It enriches them with EPSS scores and CISA KEV data, builds daily snapshots & diffs, and serves a fast, searchable static website

📋 Table of Contents

• 👨‍💻 Project Creator
• 🎯 What It Does
• ✨ Key Features
• 🧱 Architecture
• ⚙️ How It Works
• 🚀 Quick Start
• 📦 Installation
• 💻 Usage
  • Subcommands
  • Full Pipeline
• 📊 Output & Website
• 🗂️ Project Structure
• 🔧 Configuration
• 📡 Data Sources
• 📅 Automation (CI/CD)
• 📈 Trending PoCs
• ⚠️ Disclaimer
• 📄 License

👨‍💻 Project Creator

Ch4120N – Security enthusiast & automation lover.
📧 [email protected]

🎯 What It Does

1. Fetches the latest EPSS scores and CISA Known Exploited Vulnerabilities (KEV) catalogue.
2. Scans GitHub for repositories that contain exploit PoCs for CVEs (using search + GraphQL metadata).
3. Scores each candidate with a confidence model (stars, recency, keyword matches, blacklist, etc.).
4. Joins the PoC data with EPSS and KEV, then builds a complete JSON API.
5. Generates a static website with a powerful client‑side search engine.
6. Creates daily snapshots and diffs so you can track new high‑confidence PoCs.

✨ Key Features

• 🔍 Automated PoC Discovery – multi‑window GitHub code/repository search
• 🧠 Smart Scoring – code vs documentation matches, star count, recency, blacklist, and heuristics
• 📈 EPSS & KEV Integration – CISA’s KEV list and FIRST’s EPSS scores are merged with PoC data
• 📊 Daily Snapshots & Diffs – see what’s new, what was promoted to “high confidence”, and what was removed
• 🌐 Searchable Website – fuzzy search by CVE ID, vendor, product, keyword, with negative filters (-windows)
• 🚀 Fully Automated – GitHub Actions pipelines update everything on schedule
• 💾 Zero Server Costs – all data is static JSON/HTML, hosted on GitHub Pages
• 🛡️ Blacklist Support – ignore noisy or irrelevant repositories

🧱 Architecture

⚙️ How It Works

1. fetch-epss downloads the top 2000 CVEs by EPSS score.
2. fetch-kev downloads the CISA KEV catalog.
3. sync-cves reads data/github.txt and fetches CVE metadata from the MITRE API, then creates/updates markdown files for each CVE.
4. pipeline (or individual build-* commands):
   • Builds a scope of CVEs to scan (from github.txt or previously low‑confidence ones).
   • Uses the GitHub search API to find repositories mentioning the CVE ID.
   • Enriches candidates with repository metadata (stars, language, topics) via GraphQL.
   • Scores each repository and assigns a confidence tier (high, medium, low).
   • Writes per‑CVE JSON files, an index, and a top‑100 list.
   • Creates a snapshot of the current state and a diff against the previous day.
5. build-site generates CVE_list.json, trending_poc.json, and the static HTML page.

🚀 Quick Start

# Clone the repository
git clone https://github.com/Ch4120N/Ch4120N-CVE-Pulse.git
cd Ch4120N-CVE-Pulse

# Install dependencies
pip install -r requirements.txt

# Download base data
python chCVEPulse.py fetch-epss
python chCVEPulse.py fetch-kev

# Sync your initial CVE list (from data/github.txt)
python chCVEPulse.py sync-cves

# Run the full discovery pipeline (needs GITHUB_TOKEN for higher rate limits)
export GITHUB_TOKEN=your_token_here
python chCVEPulse.py pipeline --days 7

# Generate the static website
python chCVEPulse.py build-site

# Open docs/index.html in your browser

📦 Installation

Requirements:

• Python 3.9+
• pip

Install the packages:

pip install -r requirements.txt

(requirements.txt includes requests, jinja2, and any other dependencies.)

💻 Usage

All operations go through the single script chCVEPulse.py.

Subcommands

Examples:

# Fetch new data
python chCVEPulse.py fetch-epss --limit 2000
python chCVEPulse.py fetch-kev

# Update a specific CVE
python chCVEPulse.py sync-cves --cve CVE-2025-12345

# Full pipeline (daily mode)
python chCVEPulse.py pipeline --days 7 --mode daily --limit 50

# Regenerate website only
python chCVEPulse.py build-site --html-mode summary

Full Pipeline

The pipeline subcommand can be fine‑tuned:

• --days : how many days back to search GitHub (default: 7)
• --mode : daily (recent CVEs, faster) or weekly (broader scan)
• --limit : max CVEs to scan (default: 50)
• --cve : specify one or more CVE IDs to scan
• --skip-discovery : only regenerate outputs from existing data
• --check-links : verify repository URLs are still alive

📊 Output & Website

After a successful pipeline run, docs/ contains:

• index.html – the main search page (powered by logic.js and style.css)
• CVE_list.json – all CVEs with descriptions and PoC links
• trending_poc.json – recently updated PoCs (from the auto‑updated README)
• api/v1/ – full REST‑like JSON endpoints:
  • joined_top.json – high‑priority CVEs with PoCs, EPSS, and KEV status
  • kev.json – enriched KEV list
  • epss_top.json – top EPSS CVEs with PoCs
  • cve/{CVE-ID}.json – detailed PoC info per CVE
  • snapshots/ – daily state snapshots
  • diffs/ – day‑over‑day changes

The search supports fuzzy matching, vendor/product filters, and negative terms (e.g., -windows).

🗂️ Project Structure

Ch4120N-CVE-Pulse/
├── chCVEPulse.py
├── scripts/
│   ├── config.py
│   ├── helpers.py
│   ├── github_api.py
│   ├── scoring.py
│   ├── discovery.py
│   ├── outputs.py
│   ├── diff.py
│   ├── joined.py
│   ├── site.py
│   ├── sync.py
│   ├── fetch_epss.py
│   ├── fetch_kev.py
│   └── pipeline.py
├── templates/
│   └── index.html# Jinja2 template for the website
├── data/
│   ├── github.txt# CVE -> PoC URL list (edit this)
│   ├── blacklist.txt
│   ├── cache/
│   └── evidence/
├── docs/
│   ├── api/v1/
│   └── index.html, style.css, logic.js
├── requirements.txt
└── README.md

🔧 Configuration

Almost all settings live in scripts/config.py:

• GITHUB_SOURCES – path to your data/github.txt
• EPSS_API_URL, KEV_URL, CVE_API_TEMPLATE – external API endpoints
• HIGH_EPSS_THRESHOLD – minimum EPSS for “high” alerts
• TOP_KEV_COUNT – how many KEV entries to keep
• SNAPSHOT_RETENTION_DAYS – how long to keep old snapshots

📡 Data Sources

A GitHub token is recommended to increase API rate limits (set as GITHUB_TOKEN environment variable).

📅 Automation (CI/CD)

Three GitHub Actions workflows keep everything updated:

• sync_cve_pocs.yml – runs daily, reads data/github.txt, fetches fresh CVE metadata and updates markdown files.
• hot_cves.yml – runs every 6 hours, updates the Trending PoCs section in this README.
• site.yml – builds and deploys the static website to GitHub Pages.

All workflows are in .github/workflows/.

📈 Trending PoCs

The Trending PoCs table below is automatically updated every 6 hours by the CI pipeline.

2026 (latest 20 of 584 repos)

2025 (latest 20 of 594 repos)

2024 (latest 20 of 636 repos)

2023 (latest 20 of 531 repos)

2022 (latest 20 of 560 repos)

⚠️ Disclaimer

This project is intended for threat intelligence, vulnerability management, and defensive security research.
Do not use the linked repositories for any illegal or unauthorized activities.
The authors do not host or endorse the PoC code – they merely index publicly available information.

📄 License

GPLv3 License – see the LICENSE file for full text.