The daily sweep found new repositories within 2 to 9 hours where their
name carried the CVE, and up to 30 hours where only the README did. The
hourly run now searches repositories pushed in the last day for this
year's and last year's CVEs, reads their READMEs and applies the same
classifier, so a PoC published this morning is on the site within the
hour. The daily run keeps covering every year and the CVE record
references; the hourly run skips those, and skipping leaves the delta
checkpoint alone.
A sample of two hundred indexed repositories held six with nothing in
them: an empty README or none, a placeholder, a link to a paywall. A
repository with no directory, no code, no file named for the CVE or as a
PoC, and a README with no code block, command, request or real write-up
is bare, and neither discovery nor the daily audit keeps it. The audit
now reads each repository's README and root to judge that, and sweeps
4,000 repositories a day instead of 1,750, since one link in eight
pointed at a deleted repository under the fortnightly cycle.
The upstream PoC-in-GitHub collection is judged daily rather than
weekly: fourteen of the last thirty-nine additions came from it, which
means it finds repositories our own search does not.
Security slang and NVD prose rarely share a word. "sqli" found 843 CVEs
where "sql injection" found 12,719, "lpe" 80 against 1,311 for "privilege
escalation". A term now expands to its phrases and an entry matches on any
of them, with the best-scoring form counted.
A vulnerability searched by the name it is known by leads with the record
it belongs to, whatever the prose and the repository names say: ghostcat
put a different record first, moveit a newer one. Forty names are mapped.
A term with no word in the index at all is nearly always a typo. The
closest word one edit away stands in, weighed by how many records use it,
and the status line says which: citrx finds citrix, fortinte fortinet,
l0g4j log4j.
CVE pages carry BreadcrumbList markup for the home, year and block trail,
and the site publishes an OpenSearch descriptor so a browser can add it
as a search engine from the address bar.
GitHub queues runs blocked by the concurrency group in order rather than
cancelling the older one, so every cron restart added a link that waited
its turn behind the chain and the queue grew by about five a day. A link
that starts and finds another already waiting now steps aside.
A CVE List V5 record names what it is about: a title such as "PAN-OS:
Arbitrary File Creation Leads to OS Command Injection Vulnerability in
GlobalProtect", a vendor and its products. None of it was kept, so a query
for pan-os or prisma access only found records whose prose happened to say
so. Every record now opens with the title in bold and a Vendor badge per
affected vendor, refreshed from a local CVE List checkout in one pass and
kept current by the daily sync for the records it fetches. Only the lines
above the description move; descriptions and PoC sections are untouched.
The pass also settled the heading link on cve.org and trimmed the stray
space some version badges carried.
The site index carries title, vendor and product for the 40 percent of
indexed CVEs whose records have them. Search scores a hit in those above
any position in the description, results show the title as a headline,
and each page puts it under the CVE id, in the browser title, the meta
description and an Affected row, with the block hubs listing it in place
of the description's opening.
The 35 MB metadata file the homepage needed before anything could be
filtered is split in two for the page: the CVSS rows load with the rest,
the advisories follow the index instead of competing with it for the
connection. cve_metadata.json stays whole for anyone reading the API.
A sitemap gets a page discovered; a link from a page already indexed gets
it crawled and ranked. 62,000 of the CVE pages had no internal link at
all, only a sitemap entry, since the Related block only exists where two
CVEs share a PoC author. The tree is now home, year, block, CVE: one page
per year listing its thousand-id blocks, one page per block listing every
CVE in it with its PoC count and known-exploited mark, crumbs above every
CVE title pointing back up, and a year row on the homepage. No page
carries more than a thousand links. The hubs get their own sitemap shard,
dated from the newest page they contain.
Every keystroke scanned 28 MB of description text, and for terms of four
characters or more the loose regex then ran against every entry that did
not match, about 80,000 regex tests a keystroke: 100 to 230 ms on a
desktop, several times that on a phone. The index now maps each word to
the entries carrying it, built in slices after the data lands so typing
never waits on it, and a term is a prefix lookup plus a scan of the
candidates alone: 7 to 40 ms measured on the same queries. The loose form
of a term, "log-4j" for log4j, is only found by the full pass, which now
runs when the indexed pass comes back nearly empty and not otherwise. The
severity and source of an entry are cached as well, so a filter pass over
the whole index takes 20 ms instead of half a second.
Within a score tier the order fell straight through to the year, which put
five 2026 records above regreSSHion for "openssh" and kept Log4Shell off
the first page of "log4j". Ties now go to the evidence first: CISA's
listing, how many PoCs exist, how likely exploitation is, and only then
the year. A switch on the results panel offers newest and most PoCs
instead, and rides in the URL like the query and the filters. The title,
vendor and product of a record score above its prose once the records
carry them.
The two filter menus hid their state behind ALL and took two clicks per
value. Each severity and source is now its own chip in the row, always
visible: the first click narrows to that value, further clicks widen the
set, and switching the last lit chip off clears. Active chips use the
colours the result rows already use for the same words, and the
selection rides in the URL as sev= and src=, so a narrowed view can be
linked like a query.
Standalone CVE pages carried a smaller search box beside the wordmark
that read as another site's. They now open with the homepage bar itself,
same height, type and placeholder, under the wordmark with the index
count on the right. Enter still submits to /?q= because the pages are
static, and the form has a real submit button for screen readers.
Every writer now has a timeout, so a hung download cannot hold the
repository-updates lock for six hours and cancel the runs queued behind
it. The link audit moves from one 12,000-and-12,000 batch a week, which
measured an hour under that lock, to a seventh of it every day.
The social card PNG is drawn at deploy time and no longer committed: it
changed about four times a day at 68 KB a copy. nuclei.json stops
mirroring EPSS scores; every indexed CVE already has one in epss.json,
the site never fell back to the copy, and the daily recomputation
rewrote 3,400 lines of it each night.
The metadata sync retries GitHub advisory calls on 403, 429 and 5xx
instead of failing on the first one, and refuses to publish a year
shard that an NVD feed would shrink by a tenth or delete outright.
GitHub's cron scheduler creates this repository's scheduled runs four to
five hours late and drops the slots in between, so the hourly Hot CVEs
refresh cannot come from a cron. A workflow_dispatch call creates a run
within seconds, so a pacemaker workflow now sleeps until the next :05,
fires the refresh and its own successor, and keeps time by itself. Its
cron only restarts the chain if a link fails.
Hot CVEs loses its cron and the gate that was there to coexist with an
external trigger; nothing outside GitHub is involved any more.
GitHub's cron scheduler created the hourly run about five times a day,
four to five hours late. A systemd timer on the VPS now dispatches it every
hour. The cron stays as fallback and watchdog: a gate job skips it while
the trigger is alive, lets it run when the trending table is over 55
minutes old, and fails the run once it is over three hours old so the
failure email names the cause.
Also stage docs/kev.svg in every writer that redraws it, verify the index
in the link audit before committing like the other writers do, and refresh
the apt index before installing librsvg.
Commits pushed with the workflow token raise no push event, so site.yml
only ran on its 06:20 schedule and the site trailed the index by up to a
day. workflow_dispatch is exempt from that rule, so each writer now
triggers it after a successful push.
The push retry rebased onto the fetched main and, on a conflict, left HEAD
there; the next push then succeeded as a no-op and the run went green with
its changes discarded. Abort the rebase and fail instead.
CVE-BOT