---

📚 Project Documentation

📖 User Guide

Covers complete usage instructions for environment deployment, model configuration, project import, Agent auditing, one-click CVE, vulnerability management, and Skills management, and provides previews of each feature interface.

🏗️ Architecture Design Document

Introduces AutoCVE's overall architecture, Agent workflow, tool orchestration, permission protection, Agent Runtime, and ReAct Loop state-machine design.

🔌 API Documentation

Provides backend API, data structure, request parameter, and API debugging instructions.

---

✨ Core Capabilities

🚀 Complete CVE Discovery in One Click

Automates the full workflow from project selection, repository import, audit task creation, and Agent vulnerability discovery to CVE submission report generation. Users only need to copy the report content and submit it to complete the subsequent CVE application.

🤖 Multi-Agent Collaborative Auditing

The Orchestrator centrally schedules Agents such as Recon, Scan, Triage, Finding, and Verification to collaboratively complete information collection, tool scanning, false-positive filtering, deep vulnerability discovery, and dynamic verification.

flowchart LR
    O["Orchestrator"] --> R["Recon"]
    R --> S["Scan"]
    S --> T["Triage"]
    R --> F["Finding"]
    T --> V["Verification"]
    F --> V
    V --> M["Merge / Finalize"]

🧩 Three Audit Modes

Choose enhanced scanning, intelligent auditing, or comprehensive auditing flexibly according to different audit goals, balancing scanning efficiency, discovery depth, and audit coverage.

Audit Mode	Core Agent	Applicable Scenario
⚡ Enhanced Scan	Scan → Triage	Quickly analyze tool scan results and filter false positives
🧠 Intelligent Audit	Finding	Deeply discover high-value vulnerabilities; suitable for CVE and 0Day research
🔍 Comprehensive Audit	Scan → Triage + Finding	Combine tool scanning with source-code analysis for full-scale auditing

🎯 Dedicated Agent for CVE Discovery

Finding Agent is AutoCVE's core audit capability and is designed specifically for CVE discovery scenarios. It can directly analyze project source code and, together with the ReAct Loop, specialized tool calls, Nudge correction, and the structured FinalizeFinding termination mechanism, ultimately produce high-value vulnerabilities that meet CVE submission requirements.

💬 Interactive Auditing and End-to-End Tracing

• User interaction support: Treats the complete audit process as conversation context, allowing users to keep asking follow-up questions around audit results and let the Agent supplement evidence, explain attack chains, improve reproduction steps, or expand vulnerability analysis.
• Visual audit tracing: Centrally displays activity logs, Agent Tree, tool calls, phase progress, preliminary reports, and audit sessions, making it easier to review the execution path and key process of each audit.

🗂️ Intelligent Vulnerability Management and Skills Extension

• Intelligent vulnerability management: Vulnerabilities discovered during audits are automatically submitted by Agent tool calls, deduplicated, stored in structured form, and centrally maintained in the vulnerability management module.
• Dedicated Skills configuration: Supports configuring dedicated Skills for different Agents according to actual needs, flexibly extending the capability boundaries of each Agent.

---

🚀 Quick Start

⚡ One-Line Deployment Command

No need to clone the repository. Start it with one command:

curl -fsSL https://raw.githubusercontent.com/larlarua/AutoCVE/v1.0.0/docker-compose.prod.yml \
  | docker compose -f - up -d

🛠️ Source Deployment

Suitable for local development, feature debugging, or secondary development:

git clone https://github.com/larlarua/AutoCVE.git
cd AutoCVE
docker compose up -d --build

🌐 Service Access

After the services start, access them through the following addresses:

Service	Access URL	Purpose
🖥️ Frontend	http://localhost:3000	AutoCVE user interface
⚙️ Backend API	http://localhost:8000	Backend API service
📘 Swagger	http://localhost:8000/docs	API documentation and debugging
🗄️ Adminer	http://localhost:8080	Database management

[!TIP] Quickly Experience the Complete Audit Workflow

Configure model → Import project → Create audit task → Track real-time audit → Manage vulnerabilities → Edit or export report

---

🏆 CVE Discovery Results

[!NOTE] During one week of testing, AutoCVE discovered and submitted 30 security vulnerabilities, covering 14 open-source projects.

Click the CVE identifiers in the table to view official records. Complete vulnerability reports are collected in larlarua/vulnerability-reports.

🔍 View CVE Result Details (30)

CVE ID	Project	Project Popularity	Vulnerability Type	CVSS	Vulnerability Details
CVE-2026-40904	Chartbrew		Improper Access Control	8.1	View Details
CVE-2026-40603	Chartbrew		Improper Access Control	6.5	View Details
CVE-2026-40601	Chartbrew		Missing Authorization	7.5	View Details
CVE-2026-40600	Chartbrew		Improper Access Control	8.1	View Details
CVE-2026-40595	Chartbrew		Improper Access Control	7.5	View Details
CVE-2026-42181	Lemmy		SSRF	6.5	View Details
CVE-2026-42180	Lemmy		SSRF	6.3	View Details
CVE-2026-7290	JeecgBoot		SQL Injection	6.3	View Details
CVE-2026-7291	o2oa		SSRF	6.3	View Details
CVE-2026-7292	o2oa		RCE	5.6	View Details
CVE-2026-7303	xxl-job		Improper Access Control	3.7	View Details
CVE-2026-7305	xxl-job		SSRF	6.3	View Details
CVE-2026-7306	xxl-job		Hard-coded Key	5.6	View Details
CVE-2026-40610	BentoML		Link Following	5.5	View Details
CVE-2026-48763	typebot.io		Missing Authorization	8.2	View Details
CVE-2026-48764	typebot.io		SSRF	8.2	View Details
CVE-2026-48765	typebot.io		Authorization Bypass	9.9	View Details
CVE-2026-48766	typebot.io		Sensitive Data Exposure	7.6	View Details
CVE-2026-48767	typebot.io		Sensitive Data Exposure	7.6	View Details
CVE-2026-45296	OpenReplay		Improper Access Control	7.7	View Details
CVE-2026-46372	SillyTavern		SSRF	8.5	View Details
CVE-2026-45260	pimcore		Missing Authorization	8.1	View Details
CVE-2026-41235	froxlor		Incorrect Authorization	8.8	View Details
CVE-2026-41236	froxlor		Link Following	8.8	View Details
CVE-2026-43984	Tautulli		Stored XSS	8.9	View Details
CVE-2026-43985	Tautulli		CSRF	8.8	View Details
CVE-2026-43986	Tautulli		SSRF	9.9	View Details
CVE-2026-54091	filebrowser		Incorrect Authorization	7.5	View Details
CVE-2026-50279	craftcms		Improper Authorization	6.5	View Details
CVE-2026-50280	craftcms		Improper Access Control	6.5	View Details

---

⚠️ Security and Compliance

[!WARNING]

This project is only for authorized security research, code auditing, and learning or communication. It is strictly prohibited to use it for any unauthorized vulnerability scanning, penetration testing, or security assessment.

Ensure that scanning, vulnerability verification, or PoC testing is performed only against targets and environments with explicit authorization.

[!IMPORTANT]

When submitting vulnerabilities, follow the target project's security policy and vulnerability disclosure guidelines, including but not limited to:

• SECURITY.md
• GitHub Private Vulnerability Reporting
• CNA submission process
• Other responsible vulnerability disclosure mechanisms

---

💬 Communication and Feedback

[!TIP]

AutoCVE was originally designed to explore the application and practice of Agents in automated CVE discovery scenarios. At present, the project is still continuously iterating and improving, and both the architecture design and feature implementation have many areas that need refinement. Everyone is welcome to submit Issues and PRs, share usage feedback, or suggest features to jointly improve AutoCVE's reliability and practicality.

You are also welcome to contact me anytime for discussion. Whether it is a technical question, feature suggestion, or doubt encountered during CVE discovery, you can reach me through the following methods:

• 📧 Email: [email protected]
• 🐙 GitHub: @larlarua

---

🙏 Acknowledgements

[!NOTE]

In its early development stage, AutoCVE referenced and learned from the engineering architecture of DeepAudit, which provided important support for the project’s rapid start.

We would like to express our sincere gratitude to the DeepAudit project and its developers.

🧩 About AutoCVE’s Engineering Design

Building on engineering experience from relevant open-source projects, AutoCVE has been redesigned and customized for the automated CVE discovery scenario at the overall Agent engineering level. Key work includes audit workflow orchestration, ReAct Loop engineering reconstruction, state machine scheduling, loop control and termination judgment, tool orchestration, report generation, the Skill mechanism, and conversational interaction capabilities.

Going forward, AutoCVE will continue to iterate and improve, further enhancing its automation, audit depth, and practical effectiveness in vulnerability discovery scenarios.

---

License

This project is released under AGPL-3.0.