Vulnerability-Lookup (https://vulnerability.circl.lu/) is an open-source platform run by CIRCL, the Luxembourg CERT. It aggregates vulnerability data from many sources (CVE, GitHub advisories, PySec, CSAF feeds and more). It also collects "sightings": mentions, proofs of concept and exploitation reports seen on social media, in exploit databases, from honeypots and from the community. Every month we publish a report built from that data.

Highlights for October 2026:

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): two memory-safety flaws in the PHP interpreter leaked before their coordinated release on 21 October and drew 1,773 sightings. Exploitation was observed on disclosure day, five days before CISA listed them.
• 17,097 CVEs were published, a third record month in a row. Total sightings rose 20%, but proof-of-concept sightings fell 38% and exploitation sightings 20%.
• 200 vulnerabilities entered at least one of the five Known Exploited Vulnerabilities catalogs we track: CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation and Previdian. The catalogs are federated through GCVE (https://gcve.eu/), and the report includes a matrix showing which catalog covers what.
• Ivanti Connect Secure had three CISA entries. CIRCL confirmed the first one before its CVE record was published.
• Previdian covered all 36 CISA additions and flagged 19 of them earlier, in one case by 77 days.

Severity levels come from our open VLAI models (https://arxiv.org/abs/2507.03607). The report was generated with AI assistance using VulnMCP (https://github.com/vulnerability-lookup/VulnMCP). Feedback is welcome on GitHub (https://github.com/vulnerability-lookup/vulnerability-lookup/issues/).

I’ve published a new essay on my personal site, "Peeling the Onion of Computer Science": https://www.cedricbonhomme.org/2026/10/19/peeling-the-onion-of-computer-science

It’s part of my Thinking for Ourselves series, exploring the foundations of computer science, from Gödel and Turing to what remains distinctively computer science in the age of AI. Curious to hear what others think!

This release asks a question we had not asked before: how good are the actors of the vulnerability ecosystem at what they publish?

Two new scorecards answer it:

👉 The KEV catalogue scorecard grades the known-exploited-vulnerability catalogues (CIRCL, Cybersecurity and Infrastructure Security Agency, European Union Agency for Cybersecurity (ENISA), The Shadowserver Foundation, Previdian) on four pillars: how well a claim is backed, how well it is situated, how early it came, and whether the catalogue is maintained. Evidence is weighed by where it comes from, and mirrors are inferred from the data, so a copy of another catalogue is not an independent witness.

👉 The CNA and GNA scorecard grades the assigners on thirteen published rules over their records: description, scope, severity, action. Every CVE and GCVE page now shows the grade of its assigner.

This release as well introduces new visualisations for the stats page (https://vulnerability.circl.lu/stats/#stats-composition) and for the sightings (a new correlation graph: https://vulnerability.circl.lu/vuln/CVE-2026-19478#sightingsCorrelations).

🆕 Also new:

• A vulnerability timeline laying out everything dated we hold on a record: publication, KEV listings, advisories, sightings, day by day. Thanks to Alexandre Dulaunoy
• Sighting correlation graphs redrawn with Pivotick thanks to Sami Mokaddem.
• GCVE-EU BCP-05-X-03, the handling and disclosure timeline extension, read and rendered, with its exploitation events checked against the catalogues and the sightings we hold.- An audit history for CNA publications.
• A corrected exploit hazard model for young vulnerabilities thanks to Laura Cristiana Voicu

📢 The full announcement, with screenshots and upgrade notes: https://www.vulnerability-lookup.org/2026/10/14/vulnerability-lookup-6-3-0

Thanks to everyone who contributed to this release. 🙏

As usual, feel free to create an account on the instance operated by CIRCL (Computer Incident Response Center Luxembourg):

👉 https://vulnerability.circl.lu/

👋 Come meet us next week at hack.lu: https://2026.hack.lu/info/

We were also present at Vulnopticon 2026. Presentation materials are now available: https://gcve.eu/2026/09/28/gcve-at-vulnopticon-2026/

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL (Computer Incident Response Center Luxembourg) and by the European Union through the #NGSOTI project.

#VulnerabilityLookup #VulnerabilityManagement #OpenSource #GCVE #CVE #KEV #CTI

Vulnerability-Lookup is an open-source platform run by CIRCL that aggregates vulnerability advisories from many sources (CVE, GitHub, PySec, and more), enriches them with sightings from MISP, Exploit-DB, Mastodon, Telegram, Nuclei and others, and federates five Known Exploited Vulnerabilities catalogs (CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation, Previdian) through the GCVE initiative.

Every month we publish a report built from that data. September 2026 in short:

• 14,959 CVEs published, +21.5% over August and the highest monthly volume ever recorded
• 43,109 sightings across 15,296 distinct vulnerabilities
• 166 vulnerabilities entered at least one tracked KEV catalog, up from 102 in August
• CISA added 43 entries, its busiest month of the year; the ENISA feed had 19 reports, three times August
• The story is the security appliance: Citrix NetScaler (three CISA entries), Check Point, F5 BIG-IP APM, four Cisco products, Fortinet, SonicWall, MikroTik, Zyxel and Arista. The two NetScaler RCEs of 27 September reached four catalogs within a day.
• CERT.PL's "MikroTrick" RouterOS research reached the ENISA feed five days before CISA listed it
• CIRCL confirmed seven exploitations, including a PAN-OS GlobalProtect ransomware case
• Previdian (formerly KEVIntel) covered all 43 CISA additions and was ahead on 18 of them
• The Shadowserver honeypot feed stopped delivering observations after 7 September, so that section is partial

The report includes a coverage matrix showing which catalogs cover each of the 166 vulnerabilities, per-catalog tables, the exploited-CVE ratio per month of 2026, top vendors, assigners, credits and weaknesses, and a summary of community comments and bundles.

It was generated with the help of AI using VulnMCP, with VLAI severity levels from the AIPITCH models. Feedback welcome on the GitHub issue tracker.

Vulnerability-Lookup 6.1.0 is out. The highlights:

• CNA roots. The CVE Program hierarchy is now part of the platform. The assigner search accepts root: to select every CNA under a root, the vulnerability page shows the assigner's root, and a new dashboard tab lists the latest vulnerabilities of each root with per-root RSS/Atom feeds.
• CNA activity report. One page summarizing everything your local CNA/GNA did over a date range: reservations, publications, KEV entries, sightings, disclosures, comments, bundles and registrations. Charts included, Markdown export too.
• CPE Editor integration. The vulnerability page checks CPE names against the collaborative catalogue of the GCVE project (cpe.gcve.eu) and lets you propose missing vendors and products from a pre-filled form.

Also inside: sighting summaries on bundles, a Markdown export of recent vulnerabilities, the CVE Program bundle warning on flagged records, a KEV publication activity grid, frontend libraries managed with npm, and a batch of security and storage fixes.

Upgrading requires Node.js >= 18, a PostgreSQL migration and gcve >= 0.13.0. Instances that tuned kvrocks.conf should read the storage fix before restarting.

Full details on the blog: https://www.vulnerability-lookup.org/2026/09/02/vulnerability-lookup-6-1-0

Source: https://github.com/vulnerability-lookup/vulnerability-lookup

Vulnerability-Lookup (https://github.com/vulnerability-lookup/vulnerability-lookup) is an open-source platform (AGPL) for fast vulnerability lookup and correlation across many sources — CVE, EUVD, GHSA, OSV, CSAF/VEX, national CERTs — with collaborative annotation, sightings and coordinated disclosure. 6.0.0 is out today; two big additions this round.

Webhook notifications

Product notifications are no longer e-mail only. A subscription can push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — instead of, or in addition to, e-mail. HTTP method, custom headers and a payload template are all configurable, so the same mechanism feeds a generic JSON collector or the specific shape Mattermost/Teams/DingTalk/Telegram expect.

Targets are held to a strict outbound policy, enforced when the form is saved and again at delivery time: HTTPS on a standard port, no redirects, delivery pinned to the validated IP, private/loopback/link-local refused (IPv6 transition addresses judged by their embedded IPv4 destination), URL-shortener and dynamic-DNS domains rejected via the MISP warning lists, and URL paths redacted from failure logs.

Local exploit hazard

An implementation of the model from arXiv:2607.24618 (https://arxiv.org/abs/2607.24618), which turns an EPSS forecast into an exploitation risk estimate that accounts for your environment — compensating controls (globally or per attack vector), KEV policy weighting, and exponential or KEV-calibrated Weibull age decay.

• POST /api/exploit-hazard — a single vulnerability instance, resolved from a vulnerability id or from explicit values.
• POST /api/exploit-hazard/batch — aggregates a whole exposed set into the aggregate daily hazard, the expected number of exploitation events over the horizon, and the Poisson probability of at least one event.

The same model drives the notifications: reports are ordered by individual hazard and annotated with EPSS score, age and horizon probability. Each subscription can localize the estimates with its own parameters, and a daily standing exposure evaluation alerts on upward threshold crossings, listing the vulnerabilities whose remediation would lower the exposure most.

There's a longer write-up on how the paper became running code in nine days: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/

Also in this release

• A vulnerability credits index — credited researchers from CVE 5, OSSF and CSAF records, indexed and ranked at /credits/ with search and pivots from every advisory
• SSVC v2.0 decisions on the CVE page, extracted from every container (CNA and ADPs), normalized and attributed
• import_dump — bootstrap a fresh instance from the public NDJSON dumps (a one-time bootstrap, not a sync mechanism)
• EUVD: KEV catalog linking and a score-ordered EPSS index
• Security fixes: XSS in tag rendering, SSE stream gated on confirmed accounts, single-use activation/recovery tokens, outbound-URL policy on remote sync, and authenticated responses kept out of shared caches
• Project governance, maintainer list, roadmap and privacy documentation

Links

• Release notes: https://www.vulnerability-lookup.org/2026/08/13/vulnerability-lookup-6-0-0/
• Source: https://github.com/vulnerability-lookup/vulnerability-lookup
• Public instance operated by CIRCL: https://vulnerability.circl.lu/

Co-funded by CIRCL and by the European Union through the NGSOTI project.

We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.

What's New

Role-Based Access Control

The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.

Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:

The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.

AI-suggested MITRE ATT&CK techniques

The vulnerability details page gains a new ATT&CK tab with MITRE ATT&CK techniques suggested by our new AI model, trained with VulnTrain and published as CIRCL/vulnerability-attack-technique-classification-roberta-base on Hugging Face.

A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.

The approach behind this classifier is described in our paper on mapping CVEs to MITRE ATT&CK techniques.

EUVD ID allocation and creation pipeline

The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.

Feeder supervision and CSAF resilience

feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.

More VEX enrichment sources and a VEX records UI

New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).

New feeders: Rocky Linux, Ubuntu and TuxCare

New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.

Profile photo and improved public profile

Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.

Changes

• Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.

• CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
• Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
• Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
• Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
• Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.

Fixes

• Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
• Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
• Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
• Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
• Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v5.5.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/

Stegano 2.5.0 is out! 🎉

This release adds a reversible data hiding technique based on histogram shifting (Ni et al., IEEE TCSVT 2006): unlike LSB, the original cover image can be recovered pixel-for-pixel after the hidden message is extracted. Includes a new stegano-rdh command line tool.

Thanks to Eesh Saxena for the contribution!

https://github.com/cedricbonhomme/Stegano/releases/tag/v2.5.0

Vulnerability-Lookup now ingests Red Hat's per-CVE CSAF VEX documents and attaches them straight to the vulnerabilities you're already tracking. Which products are affected? Which are fixed? Which were never affected at all? One glance at the new VEX tab — or the EPSS-style VEX badge right in the vulnerability header — and you know.

No more digging through vendor advisories to answer "does this CVE actually matter to us?" 🔎

Also in this release:

✅ New /api/vex endpoints — VEX data, fully machine-readable 🔐 Per-user enable/disable of CNA publication, with a dedicated admin overview 📬 Admin overview for KEV catalog e-mail subscriptions + richer digest e-mails (entry titles, affected vendors & products) 🛠️ A batch of feeder robustness fixes — no more full re-imports or notification storms after a partial download failure

Vulnerability-Lookup is open source, and you can run your own instance today (https://www.vulnerability-lookup.org/documentation/installation.html).

👉 Release post: https://www.vulnerability-lookup.org/2026/07/10/vulnerability-lookup-5-4-0/

⭐ GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup

Feel free to create an account on the instance operated by CIRCL: 👉 https://vulnerability.circl.lu/user/signup

📚 References

Source code: https://github.com/vulnerability-lookup/vulnerability-lookup

Examples:

• https://vulnerability.circl.lu/vuln/CVE-2026-1207#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-53359#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-4631#vex
• https://vulnerability.circl.lu/vuln/CVE-2023-39361#vex

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL and by the European Union through the #NGSOTI project.

More information from the Restena Foundation: https://www.restena.lu/en/project/ngsoti

#VulnerabilityManagement #VEX #CSAF #CVE #OpenSource #CyberSecurity #ThreatIntelligence