# cve-exposure

A named set of CVEs that are each provably critical, unauthenticated, reachable over the public internet, and RCE-attaining, published within the trailing 48h, drawn from a fresh git pull of https://github.com/CVEProject/cvelistV5 plus the latest five posts from each of https://socket.dev/blog/category/security-news, https://thehackernews.com/, and https://www.ox.security/blog and For every domain on the input list a per-CVE verdict (affected or not) grounded in this run's /external-enumeration observations of its live surface - subdomains, services, favicons, webarchive URLs and The seven-column result table emitted - CVE, Product, Vector, Customer, Vulnerable Technology Used, Simple PoC, Possible Mitigating Factors and Local cache updated with per-domain tech stack and per-domain CVE verdicts, carried forward from prior runs and The exposure-flow Sankey rebuilt from this run's data and republished in place to the fixed artifact URL and A self-improvement pass recorded, turning this run's coverage gaps and friction into concrete adjustments to carry into the next cycle (Every named CVE traces to a cvelistV5 record or a cited news item from this run and independently satisfies all of critical, no-auth, network vector, RCE, and under-48h; anything unproven is dropped, not carried; Every domain verdict traces to an observation made this run - a host that resolved live, a technology re-fingerprinted, a favicon hash, an archived URL - never a carried-over assumption; The flow spec renders to out.html, is verified headlessly (DOM-shim the script, assert finite coords) and rasterized to eyeball, before publishing to the fixed URL); Authorized scope is the input domain list only; passive OSINT and unauthenticated checks - never exploit a live host, the PoC stays a replication recipe; A CVE qualifies only when all hold - critical severity, no authentication, network or public-internet vector, RCE, published within 48h; Every verdict is evidence-backed from the external surface observed this run; a CVE that cannot be tied to an observed asset is recorded as not-affected-from-external-surface, never guessed; Publishing updates the fixed artifact URL in place; never mint a new URL; Cache is authoritative across runs - append and reconcile, never blind-overwrite; resume from prior cache when present; touch only cache/**, subdomains_union.txt, out.html; or every named CVE has a per-domain verdict for all listed domains and the seven-column table is emitted or the Sankey is rendered, headlessly verified, and published to the fixed artifact URL for this run or a coverage-reflection pass over subdomains, technologies, favicons, and webarchive URLs surfaces nothing further that changes any verdict or a self-improvement pass has recorded concrete optimizations for the next cycle, or confirmed there are none

- **Kind:** goal
- **Source:** https://github.com/forefy/.context
- **Page:** https://forefy.com/goals/36a6807e-666d-4015-8553-a2b8c808aea6
- **API (JSON + files):** https://forefy.com/api/asr/36a6807e-666d-4015-8553-a2b8c808aea6

---

## goal.md

---
kind: goal
schema: goal.v1
name: cve-exposure
description: Given only a domain list, each cycle name the critical unauthenticated network-RCE CVEs published in the trailing 48h from CVE and security-news sources, verdict each named CVE against every listed domain's live external surface via /external-enumeration, emit the result table, and republish the exposure-flow Sankey to its fixed artifact URL.
end_state:
  - A named set of CVEs that are each provably critical, unauthenticated, reachable over the public internet, and RCE-attaining, published within the trailing 48h, drawn from a fresh git pull of https://github.com/CVEProject/cvelistV5 plus the latest five posts from each of https://socket.dev/blog/category/security-news, https://thehackernews.com/, and https://www.ox.security/blog
  - For every domain on the input list a per-CVE verdict (affected or not) grounded in this run's /external-enumeration observations of its live surface - subdomains, services, favicons, webarchive URLs
  - The seven-column result table emitted - CVE, Product, Vector, Customer, Vulnerable Technology Used, Simple PoC, Possible Mitigating Factors
  - Local cache updated with per-domain tech stack and per-domain CVE verdicts, carried forward from prior runs
  - The exposure-flow Sankey rebuilt from this run's data and republished in place to the fixed artifact URL
  - A self-improvement pass recorded, turning this run's coverage gaps and friction into concrete adjustments to carry into the next cycle
proof:
  - Every named CVE traces to a cvelistV5 record or a cited news item from this run and independently satisfies all of critical, no-auth, network vector, RCE, and under-48h; anything unproven is dropped, not carried
  - Every domain verdict traces to an observation made this run - a host that resolved live, a technology re-fingerprinted, a favicon hash, an archived URL - never a carried-over assumption
  - The flow spec renders to out.html, is verified headlessly (DOM-shim the script, assert finite coords) and rasterized to eyeball, before publishing to the fixed URL
guardrail:
  invariants:
    - Authorized scope is the input domain list only; passive OSINT and unauthenticated checks - never exploit a live host, the PoC stays a replication recipe
    - A CVE qualifies only when all hold - critical severity, no authentication, network or public-internet vector, RCE, published within 48h
    - Every verdict is evidence-backed from the external surface observed this run; a CVE that cannot be tied to an observed asset is recorded as not-affected-from-external-surface, never guessed
    - Publishing updates the fixed artifact URL in place; never mint a new URL
    - Cache is authoritative across runs - append and reconcile, never blind-overwrite; resume from prior cache when present
  allowed_paths:
    - cache/**
    - subdomains_union.txt
    - out.html
termination:
  stop_on:
    - every named CVE has a per-domain verdict for all listed domains and the seven-column table is emitted
    - the Sankey is rendered, headlessly verified, and published to the fixed artifact URL for this run
    - a coverage-reflection pass over subdomains, technologies, favicons, and webarchive URLs surfaces nothing further that changes any verdict
    - a self-improvement pass has recorded concrete optimizations for the next cycle, or confirmed there are none
---