Show HN: CISA CVEs with Precondition Reasoning and Default Exploitability

This repository provides contextual information for CISA’s Known Exploited Vulnerabilities (KEV), with a focus on determining whether a CVE is exploitable on default configurations. This helps teams prioritize vulnerabilities more effectively by filtering for threats that do not require custom setups or niche attack surfaces.

Many CVEs in the wild are only exploitable under specific or uncommon configurations. In contrast, vulnerabilities that are exploitable on default installations pose a higher risk to the average environment, since:

• No special hardening bypass is needed.
• The attack surface is more universally present.
• They are often leveraged in opportunistic and mass exploitation campaigns.

By surfacing this context, the data in this repo helps:

• Prioritize patching based on real-world exploitability.
• Improve risk scoring systems (e.g., for CVSS/EPSS tuning).
• Accelerate triage during vulnerability reviews.

Here’s a sample entry from cve_kb.json:

• cve_kb.json: Main knowledge base with CVEs, context, and default config exploitability.
• script.py: Utility scripts for data collection or enrichment.

1. Loads existing enriched CVEs from cve_kb.json hosted in the GitHub repo.
2. Fetches the latest KEV catalog from CISA.
3. Identifies new CVEs in the CISA KEV feed that aren't already enriched.
4. Enriches each new CVE using the Perplexity AI API:
   • Lists preconditions required to trigger the vulnerability.
   • Determines if it’s exploitable on default configurations (Yes, No, or Don't know).
   • Includes a concise reasoning behind the above decision.
   • Captures citations (if provided by Perplexity).
5. Appends the enriched entries to the existing knowledge base.
6. Updates the cve_kb.json file on GitHub using the GitHub API (no local git required).

• GitHub personal access token with repo scope (for updating files)
• Perplexity API key
• Python 3.7+

Removed CVEs Not Handled: If a CVE is removed from the CISA KEV catalog, this script does not remove it from the cve_kb.json file. This may lead to stale entries.