mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
35cb1e6962
A nuclei template is a runnable check for one CVE, which makes it a proof of concept whether or not anyone published a repository for it. Measured against the index: 3,952 CVEs gain a template link and 858 of those had no PoC at all, 584 of the additions falling in 2024 or later. That last figure is the point. ExploitDB carries more CVEs overall and Metasploit is better weaponised, but both skew historical; nuclei is where coverage of a recent CVE actually shows up first. Templates also carry the ratings the entries never had. Severity, CVSS with its vector, EPSS with its percentile and CWE now sit in nuclei.json for the site to read: 4,193 of 4,418 templates state a CVSS score and 4,274 an EPSS score. A result can finally say how bad a flaw is and how likely it is to be used, rather than only that somebody wrote code for it. Templates are kept in their own section and their own field. They are not somebody's repository and should not be ranked, starred or credited as one, but they do lead the PoC list, being the one link that runs as it stands. The index files are also revalidated rather than reused from cache. They are rebuilt hourly and a returning visitor was holding whatever it downloaded first, which cost a stale index here until the copy was thrown away by hand.