Vulnerability-Lookup#
Overview#
Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD). Vulnerability-Lookup is also a collaborative platform where users can comment on security advisories and create bundles.
A public instance operated by CIRCL is available at https://vulnerability.circl.lu.
GCVE is also running a Vulnerability-Lookup instance at https://db.gcve.eu.
Features#
Data ingestion and correlation
Feeders: Modular ingestion framework to import vulnerabilities from multiple sources. Default feeders are bundled and enabled out of the box.
Global CVE Allocation System: Native integration with the GCVE.
EPSS: Integration with the Exploit Prediction Scoring System for improved risk prioritization.
Full-text search: Optional full-text indexing across all ingested vulnerability data.
Vulnerability management
CVD process: End-to-end management of Security Advisories and Coordinated Vulnerability Disclosures.
Local sources: Support for adding instance-specific, custom vulnerability sources.
KEV catalogs: Per-instance management with synchronization of remote KEV catalogs (e.g. ENISA, CISA).
Collaboration and tracking
Sightings: Record and track vulnerability observations, including seen, exploited, not exploited, confirmed, not confirmed, patched, and not patched.
Comments: Add, review, and share analyst notes on advisories.
Bundles: Group related vulnerability advisories with contextual descriptions for easier tracking and analysis.
Watchlists: Monitor vulnerabilities affecting specific products and receive email notifications.
Integration and distribution
API: Fast and comprehensive Vulnerability-Lookup API, including cross-source correlation by vulnerability identifier.
RSS/Atom: Subscribe to vulnerability updates and comments via RSS or Atom feeds.
Synchronization: Optional synchronization of comments, bundles, sightings, and KEV entries between Vulnerability-Lookup instances.
Getting Started#
New to Vulnerability-Lookup? Follow these steps:
Review the Prerequisites
Follow the Installation guide
Explore the API v1 documentation
Subscribe to Feed syndication for real-time updates
Contributing#
If you are interested in contributing to Vulnerability-Lookup, take a look at the Contributing to the Project guide and the official repository.
By contributing, you agree to follow our Code of Conduct
Contact#
CIRCL - Computer Incident Response Center Luxembourg - info@circl.lu
License#
Vulnerability-Lookup is licensed under GNU Affero General Public License version 3.