CVE Friday Brief

Status: In development · Building in public

CVE Friday Brief is an automated vulnerability intelligence service. It works every day in the background: it collects new CVE data from public sources, filters out the noise, and adds context. Every Friday, it generates one short report with the most important vulnerabilities of the week - what they are, why they matter, and how to detect them.

The interesting part is how it works: a small team of AI agents does the job. One agent selects the CVEs that matter, one enriches them with context, one writes detection rules (Sigma / KQL), and one edits everything into a clean, readable brief.

The goal of this project is simple: build something useful, and learn multi-agent GenAI systems by doing - with every step documented on this blog.

Data sources #

• NIST NVD - the main CVE database
• CISA KEV - known exploited vulnerabilities
• EPSS - exploit probability scores
• GitHub Security Advisories - ecosystem-level advisories

Tech stack #

• Go - core service and data pipeline
• Google Agent Development Kit (ADK) - the multi-agent layer
• PostgreSQL - storage for CVE data and generated briefs
• D2 - architecture diagrams as code
• Hugo - this blog