Vulnerability-Lookup (https://vulnerability.circl.lu/) is an open-source platform run by CIRCL, the Luxembourg CERT. It aggregates vulnerability data from many sources (CVE, GitHub advisories, PySec, CSAF feeds and more). It also collects "sightings": mentions, proofs of concept and exploitation reports seen on social media, in exploit databases, from honeypots and from the community. Every month we publish a report built from that data.

Highlights for October 2026:

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): two memory-safety flaws in the PHP interpreter leaked before their coordinated release on 21 October and drew 1,773 sightings. Exploitation was observed on disclosure day, five days before CISA listed them.
• 17,097 CVEs were published, a third record month in a row. Total sightings rose 20%, but proof-of-concept sightings fell 38% and exploitation sightings 20%.
• 200 vulnerabilities entered at least one of the five Known Exploited Vulnerabilities catalogs we track: CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation and Previdian. The catalogs are federated through GCVE (https://gcve.eu/), and the report includes a matrix showing which catalog covers what.
• Ivanti Connect Secure had three CISA entries. CIRCL confirmed the first one before its CVE record was published.
• Previdian covered all 36 CISA additions and flagged 19 of them earlier, in one case by 77 days.

Severity levels come from our open VLAI models (https://arxiv.org/abs/2507.03607). The report was generated with AI assistance using VulnMCP (https://github.com/vulnerability-lookup/VulnMCP). Feedback is welcome on GitHub (https://github.com/vulnerability-lookup/vulnerability-lookup/issues/).

i'm setting up plakar as a backup tool and i wanted to use some systemd service and timer files to trigger the backups automatically. the issue is that doing so requires the plakar passhprase. what is the best way to handle this? because the best options seem to require interactivity and i need a non interactive solution. is the standard solution to simply let the passphrase as a plaintext or what?

https://archive.ph/4JXSC

This release asks a question we had not asked before: how good are the actors of the vulnerability ecosystem at what they publish?

Two new scorecards answer it:

👉 The KEV catalogue scorecard grades the known-exploited-vulnerability catalogues (CIRCL, Cybersecurity and Infrastructure Security Agency, European Union Agency for Cybersecurity (ENISA), The Shadowserver Foundation, Previdian) on four pillars: how well a claim is backed, how well it is situated, how early it came, and whether the catalogue is maintained. Evidence is weighed by where it comes from, and mirrors are inferred from the data, so a copy of another catalogue is not an independent witness.

👉 The CNA and GNA scorecard grades the assigners on thirteen published rules over their records: description, scope, severity, action. Every CVE and GCVE page now shows the grade of its assigner.

This release as well introduces new visualisations for the stats page (https://vulnerability.circl.lu/stats/#stats-composition) and for the sightings (a new correlation graph: https://vulnerability.circl.lu/vuln/CVE-2026-19478#sightingsCorrelations).

🆕 Also new:

• A vulnerability timeline laying out everything dated we hold on a record: publication, KEV listings, advisories, sightings, day by day. Thanks to Alexandre Dulaunoy
• Sighting correlation graphs redrawn with Pivotick thanks to Sami Mokaddem.
• GCVE-EU BCP-05-X-03, the handling and disclosure timeline extension, read and rendered, with its exploitation events checked against the catalogues and the sightings we hold.- An audit history for CNA publications.
• A corrected exploit hazard model for young vulnerabilities thanks to Laura Cristiana Voicu

📢 The full announcement, with screenshots and upgrade notes: https://www.vulnerability-lookup.org/2026/10/14/vulnerability-lookup-6-3-0

Thanks to everyone who contributed to this release. 🙏

As usual, feel free to create an account on the instance operated by CIRCL (Computer Incident Response Center Luxembourg):

👉 https://vulnerability.circl.lu/

👋 Come meet us next week at hack.lu: https://2026.hack.lu/info/

We were also present at Vulnopticon 2026. Presentation materials are now available: https://gcve.eu/2026/09/28/gcve-at-vulnopticon-2026/

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL (Computer Incident Response Center Luxembourg) and by the European Union through the #NGSOTI project.

#VulnerabilityLookup #VulnerabilityManagement #OpenSource #GCVE #CVE #KEV #CTI

I was getting a tour of the employees only section of a local government building and I looked down a hallway and found this. No cage. No room. Nothing more than air conditioning for controls. Just raw blinking life.

Vulnerability-Lookup is an open-source platform run by CIRCL that aggregates vulnerability advisories from many sources (CVE, GitHub, PySec, and more), enriches them with sightings from MISP, Exploit-DB, Mastodon, Telegram, Nuclei and others, and federates five Known Exploited Vulnerabilities catalogs (CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation, Previdian) through the GCVE initiative.

Every month we publish a report built from that data. September 2026 in short:

• 14,959 CVEs published, +21.5% over August and the highest monthly volume ever recorded
• 43,109 sightings across 15,296 distinct vulnerabilities
• 166 vulnerabilities entered at least one tracked KEV catalog, up from 102 in August
• CISA added 43 entries, its busiest month of the year; the ENISA feed had 19 reports, three times August
• The story is the security appliance: Citrix NetScaler (three CISA entries), Check Point, F5 BIG-IP APM, four Cisco products, Fortinet, SonicWall, MikroTik, Zyxel and Arista. The two NetScaler RCEs of 27 September reached four catalogs within a day.
• CERT.PL's "MikroTrick" RouterOS research reached the ENISA feed five days before CISA listed it
• CIRCL confirmed seven exploitations, including a PAN-OS GlobalProtect ransomware case
• Previdian (formerly KEVIntel) covered all 43 CISA additions and was ahead on 18 of them
• The Shadowserver honeypot feed stopped delivering observations after 7 September, so that section is partial

The report includes a coverage matrix showing which catalogs cover each of the 166 vulnerabilities, per-catalog tables, the exploited-CVE ratio per month of 2026, top vendors, assigners, credits and weaknesses, and a summary of community comments and bundles.

It was generated with the help of AI using VulnMCP, with VLAI severity levels from the AIPITCH models. Feedback welcome on the GitHub issue tracker.