Low Severity
Published: Nov 9, 2026
# CVE Vulnerability Research Pipeline
PoC-confirmed CVEs are automatically collected daily, and then **split into two paths**.
```
Collection(automatic) ─ Filtering(automatic) ─┬─ CTF problem creation material data/study/, data/high-severity.md
└─ Patch analysis → Bypass discovery → Vendor disclosure
data/analysis.json, reports/
```
Both are primary objectives. Collection is the common input stage for both paths, and in fact, 3 out of 5 reports sent so far have come from this archive.
- Data sources: [NVD](https://nvd.nist.gov/), [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), [GitHub Advisory Database](https://github.com/advisories), [GitHub repository search](https://github.com/search)
- Collection frequency: Once daily, `0 3 * * *` UTC (GitHub Actions `.github/workflows/collect.yml`)
- Filter: Only CVSS ≥ 6.0 with confirmed PoC saved (publication date irrelevant — old CVEs are collected if PoC emerges today)
- Format: Markdown file per CVE (`data/<year>/<CVE-ID>.md`)
- Study full list: All archive items with CVSS ≥ 8.0 always kept up-to-date in `data/high-severity.md`
- Study daily distribution: 5 items per day without duplication to `data/study/<CVE-ID>.md`. Today's new promotions → existing archive → scan entire NVD DB in descending CVSS order for those with PoC
> This file is auto-generated/overwritten when `scripts/collect.py` runs. Do not edit directly.
## Operation
1. Add newly published CVEs (CVSS ≥ 6.0) from NVD to candidate pool (`data/.pool.json`)
1b. Previously published CVEs also added 5 per day in descending CVSS order (CRITICAL→HIGH→MEDIUM buckets) regardless of publication date; cursor saved in state file
2. Detect candidates with newly added Exploit reference tags via NVD lastModified bulk query (low cost)
3. For candidates missed above, recheck those reaching recheck milestones (3/7/14/30/60/90/180/365 days post-publication) via GitHub repository search
4. When PoC confirmed, save to `data/<year>/<CVE-ID>.md` with CISA KEV/GHSA enriched info and remove from pool
5. If no PoC found after completing schedule, discard and remove from pool (not retained in archive)
6. Regenerate `data/high-severity.md` by filtering archive for CVSS ≥ 8.0 each time
6b. Incrementally query GHSA via updatedSince for **those with patch commits only** and ingest to analysis queue (`data/analysis.json`) (not added to candidate pool — GHSA lacks PoC info)
7. Study daily distribution of 5 items → `data/study/<CVE-ID>.md`. Priority 1: today's new promotions, Priority 2: existing archive, Priority 3: scan entire NVD DB in descending CVSS order for those with PoC (publication date irrelevant, continue via cursor)
## Local Execution
```bash
pip install -r requirements.txt
cd scripts
python collect.py # Incremental collection (based on state file)
python collect.py --days 3 # Force ingest recent 3 days' new CVEs (backfill)
python collect.py --verify # Archive PoC verification
```