kaidøku v0.3 — ransomware flag

What's new

Ransomware flag. kaidoku now reads CISA's Known Exploited Vulnerabilities catalog directly and shows whether a CVE is known to be used in ransomware campaigns.

• Card: a new Ransomware row (KNOWN / not known), and the verdict calls it out: "Actively exploited in the wild, including by ransomware groups"
• Batch table: a new Ransom column, and ransomware-linked CVEs now rank first within PATCH NOW
• Fresher KEV data: read straight from CISA instead of the NVD's copy, which can lag behind
• 24-hour local cache: the catalog (1,700+ entries) downloads once a day; every other run is instant and makes zero requests to CISA
• Resilient: if CISA is unreachable, kaidoku uses the last saved copy, or falls back to the NVD's KEV data. It never crashes

Example

#  CVE              Verdict          CVSS    EPSS  KEV  Ransom  Product
1  CVE-2024-3400      PATCH NOW     10.0  >99.9%  YES  KNOWN   paloaltonetworks pan-os
2  CVE-2021-44228     PATCH NOW     10.0  >99.9%  YES  KNOWN   apache log4j (+142)
3  CVE-2023-4966      PATCH NOW      7.5  >99.9%  YES  KNOWN   citrix netscaler gateway (+1)
4  CVE-2017-7269      PATCH NOW      9.8   99.8%  YES  -       microsoft internet information services
5  CVE-2024-6387      PATCH NOW      8.1   99.5%  no   -       openbsd openssh (+52)

The IIS bug has a higher CVSS than Citrix Bleed, but it ranks below it: Citrix Bleed is a confirmed ransomware tool.

kaidøku v0.2 — batch triage

What's new

Batch triage. Feed kaidoku a whole list of CVEs and get back one ranked table, most urgent first.

• Read CVEs from anywhere: --file takes any text file (Nessus/OpenVAS/Trivy exports, CSVs, emails, advisories). If a CVE ID is in there, kaidoku finds it. Duplicates and lowercase IDs are handled.
• Pipe input: cat cves.txt | python kaidoku.py -
• Ranked summary table: sorted by verdict, then CISA KEV, then EPSS, then CVSS, so actively exploited and likely-to-be-exploited issues rise to the top
• Faster: one EPSS request covers the whole batch
• Nothing silently dropped: CVEs that aren't found are listed at the end
• --cards shows the full card for every CVE in a batch

Example

python kaidoku.py --file scan-export.csv

#  CVE              Verdict          CVSS    EPSS  KEV  Product
1  CVE-2024-3400      PATCH NOW     10.0  >99.9%  YES  paloaltonetworks pan-os
2  CVE-2021-44228     PATCH NOW     10.0  >99.9%  YES  apache log4j (+142)
3  CVE-2023-4966      PATCH NOW      7.5  >99.9%  YES  citrix netscaler gateway (+1)
4  CVE-2017-7269      PATCH NOW      9.8   99.8%  YES  microsoft internet information services
5  CVE-2024-6387      PATCH NOW      8.1   99.5%  no   openbsd openssh (+52)

Single-CVE lookups work exactly as before.

kaidøku v0.1

First release.

• CVE summary card: CVSS, EPSS, CISA KEV, affected products, references
• Urgency verdict without AI (KEV > EPSS > CVSS)
• --ai plain-English briefing, tailored with --context