credkellar/cve-re repository overview

🛡️ CVE-RE — Created by Darion Kellar

A static, synthetic, defensive reverse-engineering lab cataloguing unauthenticated remote code execution (RCE) and pre-auth memory-disclosure vulnerabilities in web-facing national and international systems. CVE records are data, never exploit code — no live target is scanned, probed, or exploited, by design.

⁠📋 The catalog — 44 records

Every record carries CVE ID, nickname where one exists, vendor, product, type, CVSS (or None where unverified — never invented), CISA KEV / exploited flag, year, CWE-style class, and a remediation action.

• By type: RCE 29 · auth-bypass chain 9 · memory disclosure 6
• By vendor: Citrix NetScaler 10 · Fortinet 7 · Cisco 5 · Ivanti 4 · F5 4 · BeyondTrust 2 · Microsoft SharePoint 2 · Oracle 2 · PHP 2 · Palo Alto Networks 1 · SAP 1 · React / Next.js 1 · Fortra GoAnywhere 1 · Apache Log4j 1 · OpenSSL 1
• Names you will know: CitrixBleed (CVE-2023-4966) · CitrixBleed 2 (CVE-2025-5777) · CVE-2026-3055 · the 2026 NetScaler wave (CVE-2026-88771 / 88772 / 88779 / 107406) · ToolShell (CVE-2025-53770 / 53771) · React2Shell (CVE-2025-55182) · PHP2Shell (CVE-2026-109618 / 109619) · Log4Shell (CVE-2021-44228) · Heartbleed (CVE-2014-0160)

⁠🎓 The lesson this lab exists to teach

Patching alone is not closure for memory-disclosure and key-theft flaws:

• CitrixBleed family — patch + rotate sessions / tokens. Leaked session tokens stay valid after the patch.
• ToolShell — patch + rotate sessions + rotate ASP.NET MachineKeys. Stolen keys forge trusted requests long after patching.

The analyzer encodes this: a record reports patched_not_closed until its rotations are done.

⁠🧰 Analyzer

Deterministic priority scoring from CVSS + KEV + unauthenticated + type, a ranked patch-first list, group-by vendor and type, filter / search, and a per-CVE remediation plan (patch · patch+rotate sessions · patch+rotate sessions+keys).

⁠🧠 Brains + 🌊 Flows

• Gemini Carbon 4 Extended Thinking — DECIDER seat: MAP → MODEL → STRESS → DECIDE, engine gemini-2.5-pro, model google/gemini-carbon-4-extended-pro-thinking, thinking tiers 2048 / 8192 / 32768, offline-authoritative, can only tighten a verdict and can never override a HOLD. STRESS negative controls pass 4/4 (a patched + rotated record must not escalate).
• Google Flow — all four flows: Gemini-FlowX (13-subtask graph), Workspace Studio (plan-only), Flow Filmmaking (script → storyboard, plan-only, never renders), DataX Flow engine — all_flows_used=True.

⁠🔒 HOLD gates — 12

Live exploitation · live scanning of public targets · exploit payload generation · using disclosed credentials or sessions · persistence / webshell install · live target fingerprinting · live network probe · credential acquisition · live patch deployment · mass target enumeration · live Gemini API call · live video generation. Every one returns HOLD; only the owner can lift a gate.

⁠▶️ Run it

docker pull credkellar/cve-re:latest
docker run --rm credkellar/cve-re
python main.py            # full lab report — CHECKS 14/14
python main.py check      # self-checks only
python main.py --catalog  # all 44 records
python main.py --hold-demo  # exits 2 — gates hold

Verified: pytest 14 passed · CHECKS 14/14 PROCEED · --hold-demo exit 2. Zero runtime dependencies, one main.py, Python stdlib only.

⚠️ Honest limits: a static catalog compiled from public advisories and the CISA KEV catalog on 2026-11-07 — not a live scanner and not a feed. CVSS is None where a score was not verified. Brain seats are offline / names-only: no live API calls are made.