mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
35cb1e6962
A nuclei template is a runnable check for one CVE, which makes it a proof of concept whether or not anyone published a repository for it. Measured against the index: 3,952 CVEs gain a template link and 858 of those had no PoC at all, 584 of the additions falling in 2024 or later. That last figure is the point. ExploitDB carries more CVEs overall and Metasploit is better weaponised, but both skew historical; nuclei is where coverage of a recent CVE actually shows up first. Templates also carry the ratings the entries never had. Severity, CVSS with its vector, EPSS with its percentile and CWE now sit in nuclei.json for the site to read: 4,193 of 4,418 templates state a CVSS score and 4,274 an EPSS score. A result can finally say how bad a flaw is and how likely it is to be used, rather than only that somebody wrote code for it. Templates are kept in their own section and their own field. They are not somebody's repository and should not be ranked, starred or credited as one, but they do lead the PoC list, being the one link that runs as it stands. The index files are also revalidated rather than reused from cache. They are rebuilt hourly and a returning visitor was holding whatever it downloaded first, which cost a stale index here until the copy was thrown away by hand.
51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
name: Sync Nuclei Templates
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '25 4 * * *'
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: repository-updates
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
ScheduledRun:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
- name: Pull templates and fold them into the index
|
|
run: python3 scripts/sync_nuclei.py
|
|
|
|
- name: Check for changes and commit
|
|
run: |
|
|
git config user.name 'CVE-BOT'
|
|
git config user.email '[email protected]'
|
|
git add -- nuclei.json '[12][0-9][0-9][0-9]'
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit"
|
|
exit 0
|
|
fi
|
|
|
|
git commit -m "Sync nuclei templates $(date -u +'%Y-%m-%d') :robot:"
|
|
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
exit 0
|
|
fi
|
|
echo "Push rejected; replaying onto the current main (attempt $attempt)"
|
|
git fetch --unshallow origin main 2>/dev/null || git fetch origin main
|
|
git rebase FETCH_HEAD
|
|
done
|
|
exit 1
|