Automated CVE & Vulnerability Intelligence Tracking Pipeline

1. Introduction

Vulnerability Management is a core pillar of any organization's cyber security posture. New Common Vulnerabilities and Exposures (CVEs) are published every day, and manually tracking which of these affect an organization's software stack is time-consuming and error-prone. This task delivers an automated pipeline, built on the n8n workflow automation platform, that continuously fetches newly disclosed vulnerabilities from multiple authoritative sources, cross-references known-exploited and publicly exploitable vulnerabilities, normalizes the data, and produces a ready-to-consume report.

The objective is to ensure the organization stays up to date on any CVEs affecting its assets — including those with public exploits available — so that patches can be applied in a timely manner, reducing the window of exposure to attackers.

2. Objective & Purpose

Domain: Vulnerability Management & Assessment

Purpose: To keep the organization continuously updated on newly disclosed CVEs (including public Proof-of-Concept exploits and affected product versions) so that vulnerable applications and devices can be patched in a timely manner, minimizing exposure to active threats.

Key goals of the automation:

• Automatically fetch newly published CVEs on a recurring schedule (no manual checking required).

• Pull vulnerability intelligence in parallel from multiple independent sources — NVD, CISA KEV, CIRCL, and Exploit-DB — for broader coverage.

• Identify which CVEs have a publicly available exploit / Proof-of-Concept (PoC), using both CISA's confirmed-exploitation data and Exploit-DB's exploit catalog.

• Normalize and merge the multi-source data into a single, consistent dataset.

• Deliver the final, consolidated dataset in a clean, shareable Excel (.xlsx) report.

3. Data Sources / Platforms Used

The workflow pulls vulnerability intelligence from four authoritative, publicly accessible platforms, queried in parallel:

Combining a government-maintained feed (NVD, CISA) with community/CERT sources (CIRCL, Exploit-DB) broadens coverage and improves confidence that CVEs with real-world exploitation risk are not missed.

4. Tools & Technology

• n8n — low-code workflow automation platform used to orchestrate the entire pipeline.

• HTTP Request nodes — used to call the NVD, CISA KEV, CIRCL, and Exploit-DB endpoints.

• JavaScript Code node (Normalize CVE Data) — used to merge and reshape the raw responses from all four sources into a single, uniform dataset.

• Convert to File node — used to export the final normalized dataset as an .xlsx report.

• Schedule Trigger node — used to run the workflow automatically on a recurring interval.

5. Workflow Architecture

The diagram below shows the current end-to-end workflow as built in n8n. The pipeline runs on a schedule and fetches data from four sources in parallel — NVD, CISA KEV, CIRCL, and Exploit-DB — before normalizing all of it into one dataset and exporting the result to Excel.

Pipeline stages, in order:

• Schedule Trigger — starts the workflow automatically on a recurring interval.

• HTTP Request — fetches the latest published CVEs from the NVD API.

• HTTP Request1 — fetches the current CISA Known Exploited Vulnerabilities catalog.

• HTTP Request2 (CIRCL) — fetches the most recently published/modified CVE records from the CIRCL vulnerability database.

• HTTP Request4 (Exploit-DB) — downloads the Exploit-DB exploit index (files_exploits.csv) to cross-reference CVEs with publicly available exploits.

• Normalize CVE Data (Code node) — merges and reshapes the four source responses into one consistent set of fields (CVE ID, severity, CVSS score, affected products, exploit references).

• Convert to File — generates the final .xlsx report, ready for download and sharing with the patching team.

6. Node-by-Node Breakdown

6.1 Schedule Trigger

Triggers the workflow automatically at a fixed interval so vulnerability data is refreshed continuously without manual intervention.

6.2 HTTP Request — NVD (Fetch CVEs)

Calls the NVD REST API (services.nvd.nist.gov) to retrieve the most recently published CVEs, including their CVSS score, severity, and affected product configurations (CPEs).

6.3 HTTP Request1 — CISA KEV Catalog

Calls the CISA Known Exploited Vulnerabilities feed to cross-reference which CVEs are confirmed to be actively exploited in the wild a strong signal for patch prioritization.

6.4 HTTP Request2 — CIRCL

A GET request to vulnerability.circl.lu/api/last, pulling the most recently published or modified CVE records from CIRCL's independent vulnerability database. Each record includes the CVE ID, aliases (e.g. GHSA identifiers), publish/modified timestamps, and a detailed technical description as shown below, this run returned 30 items.

6.5 HTTP Request4 — Exploit-DB

Downloads the Exploit-DB exploit index directly from its GitLab mirror (files_exploits.csv), returned as a file. This dataset is used to flag CVEs that already have a publicly documented exploit, strengthening prioritization alongside the CISA KEV signal.

6.6 Code Node — Normalize CVE Data

A JavaScript Code node merges and reshapes the raw responses from all four sources — NVD, CISA KEV, CIRCL, and Exploit-DB — into a flat, uniform structure with the fields needed downstream: CVE ID, publish date, description, CVSS score, severity, affected products, and exploit/reference links.

6.7 Convert to File — Excel Export

Converts the final, normalized multi-source dataset into a downloadable Excel (.xlsx) file, giving the security/patching team a clean, shareable report of the CVEs that require attention.

7. Sample Output

The updated workflow was executed end-to-end and completed successfully across all nodes, now pulling and merging data from four independent sources instead of two. A sample record from the original validation run (CVE-1999–0095) demonstrates the normalized schema:

With CIRCL added, a single scheduled run now also pulls 30 additional recently-published/modified CVE records directly from CIRCL (see Figure 5), and the Exploit-DB source contributes a continuously updated exploit index (~10.2 MB CSV) that the Normalize step cross-references against incoming CVEs to flag those with known public exploits.

The final workflow execution completed with all nodes reporting success, and the Excel report was generated and made available for download via the Convert to File node.

8. Conclusion

This automation gives the organization a continuously refreshed feed of relevant CVEs, now drawing on four independent, complementary sources — NVD and CISA KEV for authoritative government-grade data, and CIRCL and Exploit-DB for broader community-driven coverage and exploit visibility. By running on an automatic schedule, merging multi-source intelligence, and exporting a clean Excel report, it removes the manual burden of vulnerability tracking and directly supports faster, better-prioritized patching decisions.

Recommendations for Future Enhancement

• Add product-specific matching (e.g., automatically flag only CVEs affecting the organization's actual software/hardware inventory).

• Send automated Slack/Email/Teams alerts for newly discovered Critical CVEs with public exploits.

• Integrate directly with a ticketing system (e.g., Jira) to auto-create patch tickets.

• Store historical CVE data in a database for trend analysis and reporting over time.

• Re-introduce an explicit severity filtering step (High/Critical only) within or after the Normalize node, now that four sources are merged.