arpsyndicate/suricata-vedasVEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for over 15k CVEs
This repository is an open, collaborative validation space for CVE detection content:
Most signatures are generated autonomously by ARPSyndicate's Vulnerability & Exploit Data Aggregation System (VEDAS). AI lets us create detection content quickly and at scale from vulnerability and exploit intelligence. Reliable detection still needs transparency, human review and real-world testing, so the content is published here for the community to review, validate, fix and extend through issues and pull requests.
15,229 unique CVEs covered. Most carry both a Suricata rule and a Nuclei template; 573 destructive or DoS CVEs are network-detection-only — a passive Suricata rule with no active Nuclei check (listed in SURICATA_ONLY.txt).
| CVE year | Suricata Signatures | Nuclei Signatures |
|---|---|---|
| 1999 | 6 | 6 |
| 2000 | 20 | 20 |
| 2001 | 27 | 24 |
| 2002 | 84 | 84 |
| 2003 | 74 | 72 |
| 2004 | 193 | 191 |
| 2005 | 539 | 538 |
| 2006 | 1,434 | 1,431 |
| 2007 | 1,183 | 1,171 |
| 2008 | 1,864 | 1,843 |
| 2009 | 872 | 861 |
| 2010 | 713 | 707 |
| 2011 | 214 | 208 |
| 2012 | 362 | 340 |
| 2013 | 259 | 236 |
| 2014 | 372 | 346 |
| 2015 | 251 | 237 |
| 2016 | 176 | 166 |
| 2017 | 444 | 413 |
| 2018 | 650 | 598 |
| 2019 | 456 | 424 |
| 2020 | 576 | 542 |
| 2021 | 778 | 736 |
| 2022 | 757 | 737 |
| 2023 | 793 | 765 |
| 2024 | 930 | 848 |
| 2025 | 579 | 557 |
| 2026 | 628 | 555 |
suricata/<YYYY>/CVE-YYYY-NNNNN.rules # one file per CVE, one rule per line
nuclei/<YYYY>/CVE-YYYY-NNNNN.yaml # one template per CVE
payloads/ # self-hosted PoC payloads (SVG/DTD/CSV/…) so checks need no external host
scripts/ # validation tooling used by CI (run it locally too)
.github/ # CI workflows, issue forms, PR template
<YYYY> is the CVE year, not the year the signature was written.
Suricata (tested on Suricata 8.x):
cat suricata/*/*.rules > vedas.rules
suricata -T -c /etc/suricata/suricata.yaml -S vedas.rules # test-load first
Or add the directory to rule-files: in suricata.yaml. SIDs 1000000-1999999 come from VEDAS and 3000000-3999999 from the community. Neither range overlaps ET Open.
Nuclei (tested on Nuclei v3):
nuclei -t nuclei/ -u https://target.example
Only scan systems you are authorised to test.
Contributions of every kind are welcome:
| You want to... | Do this |
|---|---|
| Report a rule that fires on benign traffic | False positive issue |
| Report a rule that misses real exploitation | False negative issue |
| Report a rule that fails to load or is slow | Broken signature issue |
| Ask for coverage of a CVE | Signature request |
| Fix or add a signature | Open a pull request: see CONTRIBUTING.md |
Every pull request is checked automatically. It must load in real Suricata/Nuclei engines and pass the repository lint, and the target CVE must exist on cve.org. You can run the same checks locally before pushing (see CONTRIBUTING.md).
Signatures generated by VEDAS are syntactically validated only. Logical testing has not been performed in most cases. Validate every signature in your own environment before deploying it. Community-reviewed signatures are marked as such in their pull request history. This content is provided as-is, without warranty of any kind (see LICENSE).
Signatures are self-contained and on-prem friendly: every PoC payload a check needs is stored in payloads/ and served from this repository, with no dependency on any third-party host.
VEDAS aggregates openly available intelligence (OSINT) from across the internet — vulnerability databases, advisories, exploit and PoC publications, detection rulesets, and research shared by vendors, CERTs, independent researchers, and the wider cybersecurity community. This feed is built on that collective knowledge, and we're grateful to everyone who contributes to it. Where specific detection logic was adapted from an openly licensed project — notably projectdiscovery/nuclei-templates (MIT) — it is credited in NOTICE. Community contributors are credited in each template's info.author and in the pull-request history.
Please report security issues in this repository's tooling privately. See SECURITY.md.