Reference · vuln-intel-reference
Awesome Threat Intelligence
Curated list of threat-intelligence resources organized into sources (100+ feeds like AbuseIPDB, GreyNoise, URLhaus), exchange formats (STIX/TAXII/MAEC), frameworks/platforms (MISP, OpenCTI, IntelMQ), analysis tools, and research/standards (MITRE ATT&CK, Diamond Model). ~10.5k stars.
More references
- Can I take over xyz?vuln-intel-referenceA community-maintained catalog of services (80+) vulnerable to subdomain takeover, with per-service status, regex fingerprints for identifying vulnerable endpoints, and CI verification. Includes guidance for demonstrating takeovers responsibly.
- chrome-mal-idsvuln-intel-referenceA community-maintained database of malicious Chrome/Edge extension indicators of compromise, cataloguing credential stealers, browser hijackers, supply-chain compromises, and ad-fraud campaigns. It publishes in plain-text blocklist, JSON, Sigma, STIX 2.1, and MISP formats with a multi-stage verification protocol.
- CISA KEV (Known Exploited Vulnerabilities Catalog)vuln-intel-referenceCISA's authoritative catalog of vulnerabilities known to be actively exploited in the wild, used as a hard prioritization override.
- EPSS (Exploit Prediction Scoring System)vuln-intel-referenceFIRST.org's data-driven model estimating the probability a CVE will be exploited in the wild; used to prioritize actually-exploitable vulnerabilities.
- NVD (National Vulnerability Database)vuln-intel-referenceNIST's national vulnerability database — CVE records with CVSS scoring and CPE mappings; a core vuln-intelligence data source.
- VulnRAGvuln-intel-referenceA vulnerability-intelligence platform that aggregates CVEs from seven public sources (GHSA, NVD, CVEfixes, MegaVul, BigVul, MoreFixes, Security DPO) into a canonical schema and indexes them with vector embeddings for code-similarity, pattern-based, cross-project and natural-language search. Built on Python/FastAPI with ChromaDB and transformer embeddings, it can also generate Semgrep/CodeQL detection rules and exposes REST and CLI interfaces.