About This Dashboard
A self-hosted vulnerability intelligence pipeline that aggregates, scores, and alerts on CVE data from six public sources.
How It Works
Every 30 minutes, the pipeline pulls new and updated vulnerability data from each source below, normalizes it into a local SQLite database, computes a priority score for each CVE, and sends Telegram alerts for critical findings. This dashboard is a read-only view into that database.
Data Sources
NVD — National Vulnerability Database
NIST's comprehensive CVE catalog. The primary source for vulnerability descriptions, CVSS v3.1/v4.0 scores, severity ratings, CWE weakness classifications, and CPE (affected software/hardware) data.
CISA KEV — Known Exploited Vulnerabilities
CISA's authoritative catalog of vulnerabilities confirmed to be actively exploited in the wild. Includes vendor/product identification, remediation due dates, and ransomware-use flags. Any CVE on the KEV list is automatically escalated to ACT_NOW priority.
FIRST EPSS — Exploit Prediction Scoring System
A probability model from FIRST.org that estimates the likelihood a CVE will be exploited in the next 30 days. Scores range from 0 to 1. EPSS is multiplied by CVSS to produce the dashboard's composite priority score, and drives the Trending page.
MITRE CVE List (cvelistV5)
The upstream CVE assignment authority. Ingested via the CVE Project's GitHub repository API to catch newly assigned CVEs before they appear in NVD, and to fill in CVSS data from CNA (CVE Numbering Authority) submissions.
OSV / GitHub Security Advisories (GHSA)
GitHub's curated advisory database covering open-source ecosystems — npm, PyPI, Go, RubyGems, Maven, and more. Provides ecosystem-specific severity ratings and maps advisories back to CVE IDs for correlation with other sources.
nomi-sec/PoC-in-GitHub
An enrichment source that tracks proof-of-concept exploit repositories on GitHub. The pipeline reads metadata only — repo URL and star count — and never clones or executes any code. PoC availability is a key factor in the Hunt List prioritization.
Priority Scoring
Each CVE receives a composite priority score and is assigned to one of four tiers:
Priority score = EPSS × CVSS. This weights real-world exploit likelihood against technical severity, surfacing CVEs that are both dangerous and likely to be exploited soon.
Alerting
The pipeline sends three types of Telegram notifications: push alerts for ACT_NOW tier events as they're detected, batch reports consolidating all new events from an ingest cycle, and a daily digest summarizing the last 24 hours of activity across all tiers.
Infrastructure
Self-hosted on a single VPS. The pipeline is Python, the database is SQLite with WAL mode, and this dashboard is Flask served behind nginx with TLS. The dashboard connection is read-only — it cannot modify the database. All source code is local, not on GitHub.