Vulnerability-Lookup π
A fast, open platform to correlate vulnerabilities across multiple sources β regardless of the identifier they use β and to coordinate their disclosure from a single place.
Cross-source correlation
Links related vulnerabilities together, independent of the identifier format used.
Coordinated disclosure
Built-in Vulnogram integration to draft and publish advisories as a CNA or GNA.
GCVE-native
Identifier-agnostic by design, and fully compatible with the Global CVE Allocation System.
Collaborative
Comment, bundle and share sightings β and synchronize them across instances.
Vulnerability-Lookup enables rapid correlation of vulnerabilities across multiple sources, independent of vulnerability identifiers. It streamlines Coordinated Vulnerability Disclosure (CVD) through a built-in Vulnogram integration compatible with both CVE 5.2 and GCVE-BCP-05, allowing CNAs and GNAs to publish advisories and synchronize with other instances regardless of the identifier format used.
Vulnerability-Lookup is also a collaborative platform where users can comment on security advisories and create bundles.
This software is under AGPLv3 license. You are welcome to copy, modify or redistribute the source code according to the Affero GPL license.
π€ Log in or create an account to join our community of contributors and start contributing today.
You can read the official documentation as well as the documentation dedicated to the API.
A user manual and a FAQ are also available.
π Found a bug? Report it here.
Security advisories
Vulnerability-Lookup consolidates vulnerabilities from multiple sources.
- CVE Program Creative Commons Attribution 4.0 International (CC BY 4.0) 421955 vulnerabilities
- NVD πΊπΈ Public Domain 421940 vulnerabilities
- FKIE NVD 421929 vulnerabilities
- GitHub π Creative Commons Attribution 4.0 International (CC BY 4.0) 402058 vulnerabilities
- PySec π Creative Commons Attribution 4.0 International (CC BY 4.0) 7903 vulnerabilities
- GSD Creative Commons Zero v1.0 Universal 335809 vulnerabilities
- OpenSSF Malicious Packages β Apache License 2.0 482897 vulnerabilities
- CSAF ABB 84 vulnerabilities
- CSAF CERT-Bund π©πͺ 12851 vulnerabilities
- CSAF CISA πΊπΈ 4042 vulnerabilities
- CSAF CISCO 4306 vulnerabilities
- CSAF Microsoft πͺ 20854 vulnerabilities
- CSAF NCSC-NL π³π± 1157 vulnerabilities
- CSAF Nozomi Networks 84 vulnerabilities
- CSAF OpenSuse π¦ Creative Commons Attribution 4.0 International (CC BY 4.0) 13342 vulnerabilities
- CSAF Open-Xchange 23 vulnerabilities
- CSAF Red Hat π© Creative Commons Attribution 4.0 International (CC BY 4.0) 49751 vulnerabilities
- CSAF Schneider Electric 293 vulnerabilities
- CSAF Sick 84 vulnerabilities
- CSAF Siemens 984 vulnerabilities
- CSAF Suse π¦ Creative Commons Attribution 4.0 International (CC BY 4.0) 23593 vulnerabilities
- OSV AlmaLinux MIT 5191 vulnerabilities
- OSV BellSoft MIT 22624 vulnerabilities
- OSV Haskell Ξ» Creative Commons Zero v1.0 Universal 39 vulnerabilities
- OSV Homebrew πΊ Creative Commons Zero v1.0 Universal 25223 vulnerabilities
- OSV Ocaml π« Creative Commons Zero v1.0 Universal 37 vulnerabilities
- OSV openEuler 9407 vulnerabilities
- OSV OSS Fuzz π§ͺ Creative Commons Attribution 4.0 International (CC BY 4.0) 4096 vulnerabilities
- OSV Rocky Linux 1589 vulnerabilities
- OSV Rustsec π¦ Creative Commons Attribution 4.0 International (CC BY 4.0) 1411 vulnerabilities
- OSV Ubuntu Creative Commons Attribution-ShareAlike 4.0 International 73669 vulnerabilities
- Bitnami VulnDB Apache License 2.0 7634 vulnerabilities
- Cleanstart Apache License 2.0 21867 vulnerabilities
- Drupal π§ MIT 310 vulnerabilities
- Tailscale 52 vulnerabilities
- AVID π€ MIT License 40 vulnerabilities
- CERT FR Alerte π«π· 784 vulnerabilities
- CERT FR Avis π«π· 34412 vulnerabilities
- JVNDB π―π΅ 3408 vulnerabilities
- CNVD π¨π³ 132769 vulnerabilities
- FSTEC π·πΊ 99497 vulnerabilities
- VARIoT π‘ 41946 vulnerabilities
- CERT@VDE 2 vulnerabilities
- Phoenix Contact GmbH & Co. KG 115 vulnerabilities
- Welotec GmbH 7 vulnerabilities
- CODESYS GmbH 35 vulnerabilities
- Wiesemann & Theis GmbH 7 vulnerabilities
- MB connect line GmbH 27 vulnerabilities
- Helmholz GmbH & Co. KG 25 vulnerabilities
- Festo SE & Co. KG 20 vulnerabilities
- Pepperl+Fuchs SE 34 vulnerabilities
- Pilz GmbH & Co. KG 22 vulnerabilities
- WAGO GmbH & Co. KG 84 vulnerabilities
- ifm electronic GmbH 5 vulnerabilities
- Beckhoff Automation GmbH & Co. KG 17 vulnerabilities
- Trumpf SE + Co. KG 18 vulnerabilities
- Lenze SE 7 vulnerabilities
- Carlo Gavazzi Automation 2 vulnerabilities
- AUMA Riester GmbH & Co. KG 6 vulnerabilities
- Bender GmbH & Co. KG 6 vulnerabilities
- Endress+Hauser AG 21 vulnerabilities
- Frauscher Sensortechnik GmbH 5 vulnerabilities
- Miele & Cie KG 4 vulnerabilities
- Weidmueller Interface GmbH & Co. KG 20 vulnerabilities
- SMA Solar Technology AG 7 vulnerabilities
- HIMA Paul Hildebrandt GmbH 2 vulnerabilities
- Murrelektronik GmbH 5 vulnerabilities
- SWARCO TRAFFIC SYSTEMS GmbH 1 vulnerability
- ads-tec Industrial IT GmbH 5 vulnerabilities
- VARTA Storage GmbH 1 vulnerability
- Sauter AG 2 vulnerabilities
- Janitza electronics GmbH 2 vulnerabilities
- Mettler-Toledo GmbH 8 vulnerabilities
- TIBCO 59 vulnerabilities
- Trend Micro 6 vulnerabilities
- VEGA Grieshaber KG 4 vulnerabilities
- Harman International 3 vulnerabilities
- JUMO GmbH & Co. KG 3 vulnerabilities
- Baade M2M-Products GmbH 1 vulnerability
- METZ CONNECT GmbH 1 vulnerability
- Moksha 89 vulnerabilities
- GNA-1 (CIRCL) 326 vulnerabilities
- GNA-128 (bcsec) 1 vulnerability
- GNA-123 (CI-ISAC Australia π¦πΊ) 1 vulnerability
- GNA-1337 (AHA!) 19 vulnerabilities
- GNA-1988 (VULNARCHIVE) 556 vulnerabilities
Sightings
Sightings are real-world observations of vulnerabilities, gathered by our automated collectors β monitoring sources such as the Fediverse, Bluesky, GitHub Gists and Telegram β and contributed by the community. They power the activity charts on the home page.
This page lists the sources and tools we use to collect sightings.
This instance publishes comprehensive JSON dumps of all integrated sources as open data.
Dumps are an optional open-data convenience β not a sync mechanism. For ongoing synchronisation, use the API (since=). See access patterns for automated consumers for details.
AI datasets and models derived from the project are also released on Hugging Face for public use and further research.
For automated consumers
Building a scanner, external index, or other automated client? The canonical sync path is the API (use since= for incremental pulls) β please don't enumerate the API to mirror the dataset. Identify your client with a User-Agent that includes a contact URL or email.
- Access patterns for automated consumers β authoritative human-readable guidance
- /.well-known/api-policy.json β machine-readable policy (contact, sync paths, rate-limit posture, expiry)
- /llms.txt β concise agent-facing entry point
- /robots.txt β crawler policy
- /.well-known/security.txt β security contact (RFC 9116)
Operator of the instance: Computer Incident Response Center Luxembourg (CIRCL)
Email: info@circl.lu
More information about this instance.