#gcve — Public Fediverse posts

Small update to the KEV Catalogs page in Vulnerability-Lookup.

Have a look: https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/?catalog_uuid=c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8

More KEV Catalogs:
https://vulnerability.circl.lu/kev-catalogs

#Vulnerability #OpenSource #Python #KEV #GCVE #CVE

📊 Vulnerability Report — July 2026 is out

https://www.vulnerability-lookup.org/2026/08/14/vulnerability-report-july-2026/

A record of published CVEs (+23% over June) and 61,263 sightings.

4 SharePoint flaws in CISA KEV in 4 weeks, a chained WordPress core pair topping the sightings, and a wave of Joomla extensions.

We put 5 KEV catalogs side by side: 65 vulnerabilities entered at least one in July — watching only CISA would have missed nearly half.

#CTI #KEV #VulnerabilityLookup #VulnerabilityReport #GCVE #CVE #OpenSource #CyberSecurity

If you are curious about (nearly) everything we did the past months at the GCVE.eu initiative:

https://gcve.eu/2026/08/13/gcve-recent-activities-standards-software-and-a-growing-gna-community/

We published a recap blog post.

#gcve #cve #vulnerability #vulnerabilitymanagement #cra #cybersecurity #openstandard #opensource

🚀 Vulnerability-Lookup 6.0.0 is out!

🔔 Webhook notifications — push your product reports to any HTTPS endpoint (chat, SIEM, ticketing), with a configurable payload and a strict outbound policy.

📈 Local exploit hazard — new API endpoints, hazard-ordered reports, and daily standing exposure alerts.

👥 A searchable vulnerability credits index
🧭 SSVC v2.0 decisions on the CVE page

👉 https://www.vulnerability-lookup.org/2026/08/13/vulnerability-lookup-6-0-0/

#CVE #EPSS #KEV #GCVE #OpenSource #OpenData #Software #Community #AI #CyberSecurity

vulnerability-lookup 6.0 will be released this week with many (really, many!) new features.

One of the smaller, but important, additions is support for multiple SSVC views alongside CVSS. When SSVC information is available from an ADP (such as CISA) , or from additional sources such as GCVE, it is now displayed by default.

This allows users to more easily compare the different severity and prioritization assessments associated with a vulnerability.

The CIRCL vulnerability-lookup instance is running the pre-release of 6.0 -
https://vulnerability.circl.lu/vuln/cve-2026-59124

#cve #gcve #opensource #vulnerabilitylookup #opendata #vulnerabilitymanagement #cyberecurity #ssvc

@gcve
@circl

From a research paper to running open-source code in just a few days.

We (with @cedric) have been experimenting in Vulnerability-Lookup with the concept of Local Exploit Hazard, based on the recent research paper “Modeling Local Exploit Hazard — A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency” by Stephen Shaffer and Laura Cristiana Voicu.

The idea addresses an important question in vulnerability management:

Not simply “How dangerous is this vulnerability globally?” but “How much exploitation risk does this vulnerability represent in my environment?”

Instead of introducing yet another static vulnerability score, the model starts from exploit likelihood such as EPSS and combines it with local security controls, CVSS attack vectors, vulnerability age and KEV policy to estimate an exploitation hazard.

We implemented an experimental version in Vulnerability-Lookup and connected it directly to operational workflows.

For the full details: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/

#cve #gcve #vulnerabilitymanagement #vulnerability #opensource #opendata

@circl

NatJack: A New Attack Class Against Network Infrastructure Devices

All CVEs tracked in a single bundle to see all the allocating.

#cve #gcve #natjack

https://vulnerability.circl.lu/bundle/6e833a25-b741-4cf7-9e48-1ecedcde12c9

Working on a first super beta implementation of @gcve BCP-11 "Community-Proposed Updates to Existing CVE Records"

To validate if the BCP-11 can be published.

#cve #gcve #vulnerability #opensource #opendata

Discussions https://discourse.ossbase.org/t/gcve-bcp-11-community-proposed-updates-to-existing-cve-records/1110

Pretty cool idea from @nyanbinary - a bot to analyse fucked up references from the CVE records.

@fuckeduprefs_bot

Maybe we could imagine an archive bot at the same time to ensure that the references don't get lost. Just like archive.org or similar. Maybe something for @gcve to look into.

#cve #vulnerability #gcve

Sightings have long been a major topic of discussion in the CTI community, particularly in the field of vulnerability management. We have now published a GCVE BCP to standardise the format that has been implemented, tested and used operationally in Vulnerability-Lookup for some time.

Thanks to everyone (Cédric Bonhomme, Éireann Leverett, Andras Iklody, Sami Mokaddem and many more) who participated in discussions and worked on the implementation details of sightings over the past several years. These efforts had a strong focus on practical implementation, while BCP-12 specifically addresses sightings in the context of vulnerability management.

BCP-12 is still a draft open for review, but it already provides a strong foundation for existing implementations.

https://gcve.eu/2026/08/01/gcve-bcp-12-a-standard-sighting-format-for-vulnerabilities/

#cve #cra #gcve #vulnerabilitymanagement #cybersecurity #openstandard

A new version of the BCP-11 "Community Contribution Fragments for Existing CVE Records" proposal has been published.

https://discourse.ossbase.org/t/gcve-bcp-11-community-proposed-updates-to-existing-cve-records/1110/8#p-1495-gcve-bcp-11-community-contribution-fragments-for-existing-cve-records-1

This new version is a major refactoring of the originally proposed format.

Feel free to comment, update or propose changes.

An implementation will follow when the BCP-11 reach a more stable state.

#gcve #cve #cybersecurity #vulnerabilitymanagement

@gcve

The GCVE Lab is an open space for experimenting with new ideas, tools, formats, and services related to the Global CVE Allocation System initiative.

The lab allows the GCVE community to explore promising concepts without immediately imposing the stability, compatibility, and operational requirements expected from the core GCVE infrastructure.

Open to comments/ideas.

#gcve #cve #cybersecurity

https://discourse.ossbase.org/t/gcve-lab-proposal/1117

https://gcve.eu

@[email protected] @[email protected]

282,000+ VEX records are now in Vulnerability-Lookup 🎉

🔎 https://vulnerability.circl.lu/vex

SUSE just joined Red Hat and Microsoft as a VEX source — so from any CVE you can see whether a vendor says a product is affected, fixed, or not affected.

VEX statements are attached directly to each vulnerability and available via the open API.

🧑‍💻 https://github.com/vulnerability-lookup/vulnerability-lookup

#VEX #CSAF #VulnerabilityManagement #OpenSource #InfoSec #GCVE #CVE #CYberSecurity #Vulnerability

You can now browse VEX statements in Vulnerability-Lookup!

The new VEX page lets you explore 220k+ vendor VEX records (Red Hat, Microsoft MSRC, more coming), filter by source, search by CVE ID or title, see product statuses at a glance (fixed, known affected, not affected, under investigation) and pivot straight to the related vulnerability.

🔎 https://vulnerability.circl.lu/vex/
🧩 API: https://vulnerability.circl.lu/api/vex/

#VEX #VulnerabilityLookup #CVE #GCVE #OpenSource #CyberSecurity

📦 gcve 0.12.1 is out — a small maintenance release with updated dependencies.

gcve is a Python client and CLI for the Global CVE Allocation System (GCVE), a decentralized approach to vulnerability identification where multiple GCVE Numbering Authorities can allocate IDs independently, with a cryptographically signed registry.

🔗 https://gcve.eu
🐍 pipx install gcve
💻 https://github.com/gcve-eu/gcve

#GCVE #CVE #VulnerabilityManagement #CyberSecurity #Python #OpenSource

📦 gcve 0.12.1 is out — a small maintenance release with updated dependencies.

gcve is a Python client and CLI for the Global CVE Allocation System (GCVE), a decentralized approach to vulnerability identification where multiple GCVE Numbering Authorities can allocate IDs independently, with a cryptographically signed registry.

🔗 https://gcve.eu
🐍 pipx install gcve
💻 https://github.com/gcve-eu/gcve

#GCVE #CVE #VulnerabilityManagement #CyberSecurity #Python #OpenSource

We just released cve-search v6.0.1 - it is a security and maintenance release. All users are strongly encouraged to upgrade.

Thanks to @oh2fih for the remediation fix and release support. Thanks to George Chen for the report about the security vulnerability.

#cve #gcve #cybersecurity

🔗 https://github.com/cve-search/cve-search/releases/tag/v6.0.1

A new KEV Catalog built from real-world exploitation data !

https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/?sort=first_seen&catalog_uuid=c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8

We are excited to share the result of a fruitful collaboration with @shadowserver: a new Known Exploited Vulnerabilities (KEV) Catalog (BCP-07 compliant) built directly from their global honeypot telemetry.

#ShadowServer #KEV #GCVE #Vulnerability #VulnerabilityManagement #Decentralization #Fragmentation

Improving the CPE editor for the GCVE initiative: clearer API behavior, better performance, and many other enhancements. This will be released in version 1.1 and the improvements are already in the online version.

🌍️ Online version https://cpe.gcve.eu/
:github: https://github.com/gcve-eu/cpe-editor

If you want to improve the CPE dataset, you can make proposal online.

Thanks to all the users who provided feedback for improvements @righel @cedric @jgamblin

@gcve

#gcve #cpe #cve #vulnerability #vulnerabilitymanagement #opensource #opendata

We are improving the KEV Catalogs page of Vulnerability-Lookup.

Just have a look:

👉 https://vulnerability.circl.lu/kev-catalogs

#CyberSecurity #VulnerabilityManagement #Vulnerability #GCVE #CVE #CISA #KEV #ThreatIntel #OpenSource

🎉 Vulnerability-Lookup 5.2.0 is out!

This release comes with plenty of improvements and is the result of many expensive AI tokens consumed by Claude Code under the supervision of its human orchestrator.

Curious? Have a look at the release notes:

https://www.vulnerability-lookup.org/2026/06/19/vulnerability-lookup-5-2-0/

#AI #Orchestration #Vulnerability #OpenSource #GCVE #CVE #CVD #GNA

The idea from @bagder is so interesting that it gave me the idea to extend the "GCVE-BCP-02 - Practical Guide to Vulnerability Handling and Disclosure" with "Temporary Closure of Vulnerability Intake Windows"

#gcve #cve #vulnerabilitymanagement #vulnerability #opensource #cybersecurity

🔗 Proposal https://discourse.ossbase.org/t/temporary-closure-of-vulnerability-intake-windows-potential-annex-extension-for-gcve-bcp-02/1104
🔗 Original BCP-02 https://gcve.eu/bcp/gcve-bcp-02/

cpe-editor v1.0.0 released : Establishing the Foundation for Collaborative CPE & PURL Mapping

Release note - https://github.com/gcve-eu/cpe-editor/releases/tag/v1.0.0
Online version - https://cpe.gcve.eu/

#gcve #cpe #vulnerability #vulnerabilitymanagement #cve cvd

📢 Vulnerability-Lookup 5.1.0 released!

New CNA Publication Service: publish vulnerabilities from your local instance (GCVE) directly to the official CVE Program via MITRE's CVE Services — one record, two identifiers, no duplication, with built-in moderation as part of CVD.

Plus: exploited-CVE ratio statistics, CSAF advisories in full-text search, and UI improvements.

https://www.vulnerability-lookup.org/2026/06/11/vulnerability-lookup-5-1-0/

#CyberSecurity #OpenSource #CVD #GCVE #CNA #CVE

Playing with CSAF 2.1 CSD02 and GCVE extensions.

https://discourse.ossbase.org/t/csaf-and-gcve-bcp-05-extensions/1093

I think more and more that having GCVE extension on all vulnerability standard format makes much more sense nowadays.

#gcve #cve #csaf

@gcve