VulnWatchdog

Monitoring and collection

VulnWatchdog is built to watch for new vulnerability information automatically. According to the README it monitors GitHub CVE related repositories and refreshes that monitoring every hour, which keeps the collected data close to what is being published. When it finds relevant activity it obtains vulnerability details and the associated proof of concept code, then parses the CVE information so it can be processed further. The project also includes a multi engine search capability built on several SearXNG instances that run concurrently, with automatic failover when one instance is unavailable. That design matters because public search instances are unreliable, and a monitoring tool that depends on a single source would miss results whenever that source goes down. By spreading queries across multiple instances and failing over, VulnWatchdog improves the chance of collecting relevant proof of concept repositories even when individual instances are slow or blocked. The hourly cadence and the proof of concept focus suggest the tool is meant for defenders and researchers who want early visibility into freshly disclosed issues rather than a periodic compliance scan. The README presents collection and parsing as the foundation that the analysis stage later consumes, so the quality of the final report depends heavily on how completely this stage gathers the raw material.

Analysis and reporting

After collection, VulnWatchdog uses GPT to analyze the vulnerability information and the proof of concept code it gathered, then generates structured Markdown analysis reports. The README lists risk assessment as a feature, noting that the tool automatically evaluates a vulnerability's risk level and also estimates poisoning risk, which is the chance that a published proof of concept or dependency carries something malicious. That second check is relevant because the security community has seen poisoned repositories and trojaned exploits distributed through public sources. The project also supports real time notification through webhooks, with Feishu listed as the notification type, so a team can receive alerts as new analyses complete rather than polling the repository. The report format is Markdown, which makes the output easy to read, archive, or feed into another system. The choice to drive analysis with a language model means the reports can explain the collected material in natural language, but it also means the quality depends on the configured model and prompt. The README shows gemini-2.0-flash as the default model name, and the analysis step is optional and toggled by configuration. The combination of monitoring, model based analysis, and notification turns a stream of CVE activity into a smaller set of actionable writeups.

Deployment model

The README recommends deploying VulnWatchdog through GitHub Actions. The steps are to fork the repository into your own GitHub account and then configure secrets under Settings, Secrets and variables, Actions. The required secrets depend on which features you enable: WEBHOOK_URL is needed when notifications are on, and GPT_SERVER_URL, GPT_API_KEY, plus an optional GPT_MODEL are needed when GPT analysis is on. The README notes that GH_TOKEN, a GitHub personal access token with public_repo scope, is optional but recommended, and it compares API rate limits across configurations, from 60 requests per hour when nothing is configured, to 1000 per hour from the automatic GITHUB_TOKEN, up to 5000 per hour with a configured GH_TOKEN. Function toggles live in config.py, where ENABLE_NOTIFY, NOTIFY_TYPE set to feishu, ENABLE_GPT, and ENABLE_SEARCH control behavior. This design lets a user run the tool entirely in a free GitHub Actions runner without standing up a server, which lowers the barrier to continuous monitoring. The tradeoff is that the user must supply their own GPT endpoint and API credential, and the analysis quality is bounded by that external service. Because the secrets are stored in the forked repository's settings, the whole pipeline runs inside GitHub's infrastructure on a schedule. The source is hosted at github.com/arschlochnop/VulnWatchdog and its most recent commit was on 2026-08-26.

Editorial conclusion

VulnWatchdog is an automated CVE monitoring and analysis tool. It monitors GitHub CVE related repositories, obtains vulnerability information and proof of concept code, and uses GPT to analyze that material and produce structured Markdown reports. It supports Feishu webhook notifications and evaluates both risk level and poisoning risk. The source is hosted at github.com/arschlochnop/VulnWatchdog and its most recent commit was on 2026-08-26.