Vulfixx - Advanced CVE Tracker

A robust Go-based application for tracking and alerting on new Common Vulnerabilities and Exposures (CVEs) from the NIST NVD database.

Intelligence Features

• Advanced Alert Routing: Precision delivery of alerts to different channels based on severity or risk profile.
• Complex Boolean Alert Filters: Surgical alert filtering using multi-variable logic (e.g., severity > 8 && epss > 0.1).
• Dynamic Resource Quotas: Tiered limits for subscriptions and assets per user/team to optimize performance and resource utilization.
• Audit Logs for Remediation: Comprehensive chronological tracking of all vulnerability status changes and manual acknowledgments.
• Community OSINT Intelligence: Automated discovery of technical discussions on Hacker News and Reddit for every threat with Social Sentiment Heat Scores.
• Zero-Bloat Vendor Advisories: Enhanced multi-format synchronization (RSS 1.0, 2.0, and Atom) for official bulletins from CISA, Microsoft, Cisco, Ubuntu, Red Hat, and more, with a strict "matched-only" policy to prevent data bloat.
• Social Buzz & Threat Trending: GitHub-integrated "Buzz" meter that tracks community interest and public PoC presence.
• EPSS Integration: Exploit Prediction Scoring System (EPSS) integration for probability-based risk assessment.
• Smart Alert Batching: Redis-backed intelligence buffering that groups related threats into unified reports.
• Actionable Notifications: Direct "Acknowledge" and "Mute" functionality embedded in email alerts.
• Infrastructure Context: Automatic mapping of vulnerabilities to specific infrastructure assets.
• Enhanced Observability:
  • Self-Healing Health Checks: Automated verification of sync workers with critical alerting.
  • Error Tracking: Backend and frontend reporting integrated via Sentry.
  • Performance Benchmarking: Integrated CI checks for request latency and worker throughput.
• Modern User Experience:
  • Skeleton Loading States: Shimmering placeholders for perceived speed during data fetches.
  • High-Density Data Mode: A specialized "compact" view toggle for analysts handling hundreds of vulnerabilities.
  • Guided Onboarding: Interactive welcome tours for new analysts.
• CWE Classification: Deep vulnerability categorization using Common Weakness Enumeration (CWE) intelligence.
• Duplicate Detection: Intelligence-based grouping of identical vulnerabilities reported via multiple channels.
• Infrastructure-as-Code: Automated dependency updates via Dependabot for Go and NPM.
• Automated Intelligence: Weekly email summaries and CISA KEV automated synchronization.
• Enhanced Telemetry: Risk Profile distribution charts and direct Proof-of-Concept (PoC) discovery links.
• Asset-Linked Monitoring: Proactive infrastructure defense via asset-keyword mapping.
• Priority Classification Engine: Automated P0-P3 threat scoring based on CVSS, EPSS, and CISA KEV presence to prioritize critical remediation.
• Secure Integration: Filtered, token-authenticated RSS feeds for personalized technical intel.
• Rich Email Alerts: Premium HTML notifications with OSINT links, Vendor advisories, and Risk gauges.
• Modern UI: High-density dashboard with a premium glassmorphic Amber theme, built on a custom SPA navigation framework for high-performance, seamless transitions. Features interactive column sorting, dynamic multi-variable filtering, and synchronized risk distribution charts.
• High-Density CWE Visualization: Ultra-compact dashboard grid displaying the top 15 vulnerability types with localized amber theme styling and ultra-compact 10px bars.
• Intelligent CWE Name Mapping: Robust server-side resolution of human-readable CWE titles (e.g., 'SQL Injection') for data points missing NVD metadata.
• Advanced Vendor Intelligence: Enterprise-grade product detection engine using NVD CPE (Common Platform Enumeration) strings for high-fidelity identification of Vendors and Products.
• Categorized Software Impact: Automatic classification of vulnerable assets into Application (a), Operating System (o), and Hardware (h) categories with visual distinction.
• Multi-Product Intelligence: Structured JSONB storage supporting the extraction and tracking of multiple affected products per CVE, backed by GIN (Generalized Inverted Index) for high-performance sub-second queries.
• Vendor Name Normalization: Centralized alias mapping system that unifies inconsistent vendor names (e.g., microsoft_corp → Microsoft) for professional-grade reporting.
• Intelligence Sync Optimization: High-throughput synchronization engine with batch processing (200 CVEs/run) and automated 30-day refresh cycles for existing records.
• OSV & GreyNoise Integration: Enhanced monitoring for Open Source Vulnerabilities (OSV) and GreyNoise threat intelligence with automated stale-data detection.
• LLM-Powered Detection: Advanced extraction of Vendor, Product, and Affected Versions from complex descriptions using Local LLMs (Ollama), Cloud APIs (Gemini), or OpenAI Compatible endpoints.
• Ransomware & Threat Actor Intel Mapping (Strategy 1 & 3): Zero-cost active Ransomware Campaign & Threat Actor matching utilizing CISA KEV "knownRansomwareCampaignUse" extraction alongside a dynamic, high-performance OSINT public intelligence feed sync with a curated fallback baseline. Exposes premium "Ransomware Active" badges and multi-actor detail panels without any external paid API requirements.
• Production-Grade Security Hardening: Comprehensive platform-wide hardening, including zero-bypass environment checks, percent-encoded database DSNs, fail-closed rate limiters/session middlewares, closed listener port leaks, buffered response marshalling, scrubbed PII loggers, whitelisted workers, and 100% test-verified conformance.
• Release v2.5.6 Consolidation: Consolidates 75 open Pull Requests, resolving dependency updates, modernizing Go patterns, hardening template security, and fixing unit test regressions across all workers and database mock layers.

🤖 LLM Intelligence (Optional)

Vulfixx can use Large Language Models to "fill in the blanks" when official NVD metadata is missing or incomplete. This is especially useful for older CVEs or non-standard reports.

Local LLM Setup (Recommended)

By default, Vulfixx is configured to use Ollama for private, local, and free CPU-based extraction.

1. Start the services: docker-compose up -d.
2. Download a model to the local container:

   docker exec -it vulfixx-ollama-1 ollama pull phi3

3. The worker will now automatically use the local model for any CVE missing vendor/product data.

Cloud LLM Setup

If you prefer higher performance, you can use Google Gemini:

1. Obtain a Gemini API Key from Google AI Studio.
2. Set LLM_PROVIDER=gemini and GEMINI_API_KEY=your_key in your environment.

OpenAI Compatible API Setup

You can also use custom/local endpoints compatible with the OpenAI Chat Completions API (such as local LLM proxies or custom workspaces):

1. Configure LLM_PROVIDER=openai in your environment.
2. Set OPENAI_ENDPOINT (e.g. http://100.115.58.99:18080/workspace/sys-kilo/v1), OPENAI_MODEL (e.g. kilo-auto/free), and OPENAI_API_KEY (optional).

🏗️ Architecture

The application follows a modular architecture designed to prevent monolithic files and improve domain separation.

Web Layer (internal/web)

• base.go: Core middlewares (Auth, Admin, Proxy, Security), template rendering, and global stats caching.
• auth_handlers.go: User identity, registration, and email verification.
• dashboard_handlers.go: CVE monitoring, interactive sorting, status updates, and notes management.
• subscription_handlers.go: Keyword subscriptions, RSS feeds, and alert actions.
• asset_handlers.go: IT Asset inventory and keyword mapping.
• activity_handlers.go: Audit logging and JSON activity exports.
• alert_handlers.go: Chronological notification history.
• admin_handlers.go: Administrative user management.

Worker Layer (internal/worker)

• alert_worker.go: CVE queue processing and multi-variable filtering.
• alert_buffer.go: Redis-backed digest creation and delivery delay logic.
• notifier.go: Multi-channel dispatcher (Email, Webhooks) with SSRF/DNS protection.
• email_worker.go: SMTP delivery and verification email queue.
• sync_nvd.go: NVD CVE data synchronization with incremental backoff.
• sync_github.go: GitHub Social Buzz and PoC discovery tracking.
• sync_cisa.go: Automated CISA KEV catalog synchronization with high-visibility extraction of ransomware campaign flags (cisa_ransomware).
• sync_threat_intel.go: Automated synchronization of public OSINT threat intelligence feeds mapping active Ransomware Campaigns and targeting Threat Actors to CVE records, supported by curated baseline fallback data.
• sync_advisory_rss.go: Generalized multi-format synchronization (RSS 1.0, 2.0, and Atom) for official bulletins from CISA, Microsoft, AWS, VMware, Oracle, GitHub, CERT-EU, FortiGuard, Cisco, Red Hat, Ubuntu, and ZDI. Implements a "matched-only" policy via processAdvisoryFeed (must contain valid CVE-ID) and integrateAdvisoryCVE (only syncs if the CVE already exists in the database) to prevent data bloat.
• sync_epss.go: Probability-based risk scoring (FIRST EPSS).
• cron_worker.go: Scheduled tasks (Weekly summaries).

⚡ Core System Hardening & Performance

Vulfixx is hardened with enterprise-grade system improvements designed for high-availability, performance, and transactional safety:

• Redis-Backed Session Store: Migrated from client-side cookie stores to server-side Redis session storage using github.com/rbcervilla/redisstore/v9, enabling instant session revocation and enhanced security. Retains an automatic, secure encrypted CookieStore fallback for local or test environments without a running Redis instance.
• Standardized Structured Logging (log/slog): Global transition to standard library structured logging (log/slog) with context support. Configured to output clean, high-performance JSON logs in production for ingestion by log collectors, and a human-readable structured output in development environments.
• Database Connection Pool Optimization (pgxpool): Configured customized connection pool limits explicitly (MaxConns = 25, MinConns = 5, MaxConnLifetime = 30m, MaxConnIdleTime = 15m) to guarantee ready warmed connections and prevent database connection starvation.
• Worker Graceful Shutdown & Atomic Sync Transactions: Enhanced background synchronization processes (NVD, CISA KEV, RSS Advisory feeds) to run in atomic Postgres database transactions (pgx.Tx), ensuring incomplete sync operations are safely rolled back on failure or worker shutdown. All sync loops validate active context cancellation (ctx.Done()) at iteration boundaries for clean graceful exits.
• Decoupled Task Queue Architecture (Asynq): Shifts heavy background tasks (alert evaluations, verification emails, and email changes) off the HTTP flow using github.com/hibiken/asynq with automated exponential backoff retries.
• High-Performance Routing Layer (Chi): Replaced Gorilla Mux with modern standard-compliant github.com/go-chi/chi/v5 featuring sub-routing, timeout propagation, and custom rate-limiting middleware.
• Secure gRPC Query Interface: Exposes a secondary high-speed gRPC server on port :9091 to support sub-millisecond external CVE intelligence queries.
• Real-time Activity Stream (SSE): Streams live audit log activities directly to the dashboard utilizing Server-Sent Events (SSE) backed by Redis Pub/Sub.
• Optimistic Locking & Concurrency Control: Uses version columns on target entities to prevent conflicting updates during manual analyst modifications.
• Exclusively Argon2id Password Hashing: Fully eliminated legacy Bcrypt support in favor of the more modern, computationally intensive Argon2id algorithm, hardened with pre-computed timing-safe dummy verification to completely neutralize side-channel user enumeration attempts.

Getting Started

Prerequisites

• Docker
• Docker Compose
• Go 1.26.3 (optional, for local development)
• act (optional, for running GitHub Actions locally)

Installation

1. Clone the repository:

   git clone https://github.com/arumes31/vulfixx.git
   cd vulfixx

2. Configure environment variables in docker-compose.yml:

   • SMTP_HOST: Your external SMTP server address.
   • SMTP_PORT: SMTP server port (e.g., 587).
   • SMTP_USER: SMTP username.
   • SMTP_PASS: SMTP password.
   • SESSION_KEY: A secure random string for session signing.
   • CSRF_KEY: A secure random string for CSRF protection (exactly 32 bytes).
   3. Start the application:

   docker-compose up --build

   Running with GHCR (GitHub Container Registry)

   If you prefer not to build the image locally, you can use the pre-built image from GHCR:

   docker-compose -f docker-compose.ghcr.yml up

   The application will be available at http://localhost:8080.

   Configuration

   The application is configured via environment variables in the docker-compose.yml file:

Variable	Description	Default
DB_HOST	PostgreSQL host	db
DB_PORT	PostgreSQL port	5432
DB_USER	PostgreSQL user	cveuser
DB_PASSWORD	PostgreSQL password	cvepass
DB_NAME	PostgreSQL database name	cvetracker
DB_SSLMODE	PostgreSQL SSL mode (disable, prefer, require, verify-full)	prefer
REDIS_URL	Redis connection URL	redis:6379
SMTP_HOST	External SMTP server	smtp.example.com
SMTP_PORT	SMTP server port	587
SMTP_USER	SMTP username	user@example.com
SMTP_PASS	SMTP password	password
SMTP_MAILFROM	Sender address for emails (defaults to SMTP_USER)	alerts@example.com
SESSION_KEY	Session signing key	supersecretkey...
CSRF_KEY	CSRF protection key (32 bytes)	0123456789...
SECURE_COOKIE	Enable secure cookie flag (for HTTPS)	true
BASE_URL	Application base URL	http://localhost:8080
ADMIN_EMAIL	Seed administrator email	admin@example.com
ADMIN_PASSWORD	Seed administrator password	change-me
ADMIN_TOTP_SECRET	Seed administrator TOTP secret (base32)	YOUR_SECRET
NVD_API_KEY	NIST NVD API Key (for higher rate limits)	(empty)
NVD_API_URL	Custom NVD API endpoint (optional)	https://...
APP_ENV	Application environment (development, production)	production
PORT	Application server port	8080
SENTRY_DSN	Sentry DSN for error reporting	(empty)
LLM_PROVIDER	LLM provider chain, comma-separated (ollama, gemini, mistral, openai)	ollama
LLM_ENDPOINT	API endpoint for local LLM (Ollama)	http://ollama:11434
LLM_MODEL	Model name for Ollama (e.g. phi3-vulfixx, llama3)	phi3-vulfixx
LLM_TIMEOUT	Intelligence extraction timeout (seconds)	600
GEMINI_API_KEY	API Key for Google Gemini provider	(empty)
GEMINI_MODEL	Gemini model version	gemini-3.1-flash-lite
GEMINI_API_VERSION	API version for Google Gemini provider (must be v1beta for structured output)	v1beta
GEMINI_RPM	Free-tier requests-per-minute used to pace Gemini calls (raise for paid tiers / higher-limit models)	15
GEMINI_RPD	Free-tier requests-per-day hard ceiling, tracked in Redis per UTC day (0 disables; raise for paid tiers)	500
MISTRAL_API_KEY	API Key for Mistral AI provider	(empty)
MISTRAL_MODEL	Mistral model (e.g. mistral-small-latest)	mistral-small-latest
MISTRAL_ENDPOINT	Mistral API base URL	https://api.mistral.ai/v1
OPENAI_API_KEY	API Key for OpenAI Compatible provider	(empty)
OPENAI_MODEL	Model name for OpenAI Compatible provider	kilo-auto/free
OPENAI_ENDPOINT	Endpoint for OpenAI Compatible provider	http://100.115.58.99:18080/workspace/sys-kilo/v1
LLM_DEBUG	Enable raw LLM prompt/response logging (true/false)	false

Ollama Server Tuning (Ollama container only)

Variable	Description	Default
OLLAMA_KEEP_ALIVE	How long the model stays in RAM (e.g., 24h)	24h
OLLAMA_LOAD_TIMEOUT	Max time allowed for model loading/ops	600s
OLLAMA_NUM_PARALLEL	Concurrent request slots	4
OLLAMA_MAX_LOADED_MODELS	Max models kept in memory	1
OLLAMA_DEBUG	Enable verbose Ollama server logs	1

Security Warning: The default seed values for ADMIN_EMAIL, ADMIN_PASSWORD, and ADMIN_TOTP_SECRET are insecure and must be changed before deploying to production. Please generate a strong password and a unique base32 TOTP secret. It is highly recommended to rotate the seeded admin credentials and remove defaults from any production configuration.

Development

Running Tests

To run the Go test suite:

go test ./...

To run tests with the race detector enabled (requires CGO and a C compiler like GCC):

# On Windows, install WinLibs MinGW via winget if not present:
# winget install BrechtSanders.WinLibs.POSIX.UCRT

# Then run with CGO enabled (adjust gcc path as needed):
$env:CGO_ENABLED="1"
go test -race ./...

Or use the automated test script with coverage:

./run_all_tests.sh

CI/CD Pipeline

This project uses a modern GitHub Actions pipeline (.github/workflows/docker-build.yml) for continuous integration:

• Environment: All CI jobs run in a Go 1.26.3 containerized environment.
• Unit Testing: Automated Go tests to ensure logic correctness.
• Linting: Strict code quality checks with golangci-lint (v2.x).
• Security Scanning:
  • Gsec: Static Analysis (SAST) with gosec.
  • Govul: Vulnerability scanning with govulncheck.
  • Godep: Dependency security scanning with osv-scanner.
• Styling: Modernized CSS pipeline with Tailwind CSS v4 for high-performance, zero-runtime styling.
• Container Publishing: Images are automatically built and pushed to GitHub Container Registry (GHCR).

To run the entire CI pipeline locally using act:

act

Or run specific jobs:

act -j test
act -j lint

Local Development Scripts

For convenience, several shell scripts are provided to automate common tasks:

• run_all_tests.sh: Runs all tests with coverage and displays a summary.

• test_lint.sh: Executes golangci-lint with the project's configuration.

• fix_worker_panic.sh: Utility for patching specific worker edge cases.

• fix_errcheck.sh: Utility for automated error checking fixes.

• Public SEO Dashboard: High-performance public threat intelligence portal with built-in Schema.org JSON-LD structured data and Open Graph meta-tags for search engine authority.

• Sitemap & Search Discovery: Automated generation of sitemap.xml and robots.txt for efficient crawling of the top 1000 threats.

• CSP Nonce Hardening: Advanced Content Security Policy implementation using unique per-request nonces for all inline script execution.

🗄️ Database Migrations (Goose)

Vulfixx integrates Goose (the Go-native database migration framework) for robust, versioned database schema alterations and automated upgrades.

Key Features

• Dynamic Connection Strings: Credentials and connection options (DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME, DB_SSLMODE) are dynamically gathered from the environment at startup to construct secure PostgreSQL connection strings.
• Embedded Migrations: All SQL migrations are compiled directly into the Go binary using //go:embed and executed programmatically on application startup.
• Zero-Dependency Execution: No external python interpreter, pip dependencies, or site-packages are required. The migrations run instantly with microsecond latencies.

CLI Usage (Optional)

If you install the goose CLI tool, you can inspect or manage migrations manually:

# To check the status of migrations
goose -dir internal/db/sql/migrations postgres "host=localhost user=youruser dbname=yourdb sslmode=disable" status

# To manually apply migrations
goose -dir internal/db/sql/migrations postgres "host=localhost user=youruser dbname=yourdb sslmode=disable" up

🛡️ Security Hardening & Audit

The codebase has undergone a comprehensive security audit (April 2026) using automated static analysis (gosec), dependency scanning (govulncheck), and manual penetration testing of the public surface.

Recent Remediation Actions

• Route Token Leak Protection: Removed sensitive tokens from URL path parameters in favor of query-based extraction, preventing token leakage in web server access logs and browser histories.
• Nil-Pointer Safety in RenderTemplate: Implemented dynamic reflection checks on templates using v.IsNil() to completely eliminate runtime nil pointer panics on pointer rendering paths.
• Redis Client Safety: Hardened the dashboard handlers with safety checks to gracefully handle uninitialized Redis caches, falling back cleanly to direct database queries.
• JSON Marshaling Error Mitigation: Ensured all OSV synchronization routines log and gracefully handle JSON serialization errors, avoiding silent database corruption or data loss.
• XSS Mitigation (CSP Nonces): Implemented unique per-request cryptographic nonces for all inline scripts.
• Structured Data Protection: Hardened JSON-LD generation with backend marshaling and template.HTML escaping.
• Public Surface Abuse Prevention: Integrated RateLimitMiddleware on all public SEO routes and implemented strict pagination depth validation.
• SSRF Mitigation: Implemented strict URL validation and scheme checks in all worker synchronization tasks.
• SMTP Injection Protection: Centralized email sanitization (sanitizeEmail) with CR/LF stripping and proper RFC parsing.
• Session Security: Enforced SameSite=Lax cookie policy and made sslmode configurable for secure production database connections.
• SQL Injection Prevention: 100% migration to parameterized queries via pgx/v5 for all search and filter logic.

Automated Checks

The CI pipeline automatically runs:

• golangci-lint: For code quality and best practices.
• gosec: For vulnerability scanning and static security analysis.
• go test: Comprehensive unit and integration test suite.

License

This project is licensed under the MIT License.