CVE-SIGNAL

A lightweight Python pipeline that monitors new high-severity web and cloud CVEs, looks for relevant public exploit references, and sends useful alerts to Telegram.

I built this pipeline for personal use, but its severity thresholds, CWE filters, technology keywords, vulnerability criteria, and exclusions can all be tailored to your own needs, feel free to fork it and edit to your own needs, customization options are listed below.

What it does

Every three hours, GitHub Actions:

1. Fetches recently published or updated CVEs from the NVD.
2. Filters them by CVSS score, CWE, cloud/web technology, and configurable keywords.
3. Searches exploit-oriented NVD references, richer Exploit-DB metadata, and public GitHub repository names, descriptions, topics, and README files for possible exploit or PoC matches.
4. Ranks up to five evidence-backed matches and sends the result to Telegram.
5. Rechecks recent CVEs and sends one follow-up when a newly published exploit URL appears, without repeating previously delivered links.

An initial CVE alert can report that no public exploit was found yet. The CVE remains eligible for enrichment until maximum_cve_age_hours expires, so a delayed PoC can generate a follow-up alert. The project only links to public exploit metadata and repositories; it does not download or execute exploit code.

Use it yourself

Fork this repository, then open:

Settings → Secrets and variables → Actions

Add these repository secrets:

Secret	Purpose
NVD_API_KEY	Recommended API key from the NVD.
TELEGRAM_BOT_TOKEN	Token created through @BotFather.
TELEGRAM_CHAT_ID	Your public channel username or private channel numeric ID.

The GitHub PoC search uses the short-lived, read-only GITHUB_TOKEN created automatically by GitHub Actions. You do not need to create another GitHub secret.

Enable Actions in your fork and run the CVE Signal workflow manually with dry_run enabled. Once the output looks right, run it with dry_run disabled. Scheduled runs then execute every three hours.

Edit config.toml to change:

• CVSS range and maximum CVE age.
• Cloud providers and web technologies.
• Vulnerability keywords and CWE identifiers.
• Excluded terms and number of exploit matches.

Run locally

Python 3.11 or newer is required. The project currently uses only the Python standard library.

PYTHONPATH=src python -m cve_signal --dry-run

Useful options:

PYTHONPATH=src python -m cve_signal --since-hours 3 --dry-run
PYTHONPATH=src python -m unittest discover -s tests -v

Set NVD_API_KEY, TELEGRAM_BOT_TOKEN, and TELEGRAM_CHAT_ID as environment variables before a live local run. Never commit them.

Optional LLM enrichment

The current matcher is deterministic: it uses CVE IDs, source tags, product terms, vulnerability metadata, and repository names/descriptions. LLM could be added to better analyze the web and find better exploit matches and suggestions.