Security

We're excited to share the latest features designed to make vulnerability tracking even more efficient.

🚀 What's New

🆕 Email Notifications (Product Watch List)

Stay ahead with hourly, daily, or weekly alerts for new or updated vulnerabilities affecting the vendors and products you care about. Notifications come in both HTML and plain text, with CSV attachments detailing vulnerabilities, sightings, and comments. (#101)

The notification management interface

Future releases will allow users to create notifications by specifying just a vendor, optionally a version, and to be notified about new sightings related to a product or vulnerability.

Various email notifications

The screenshot below shows a list of notifications aggregated in an email client. It's easy to aggregate messages by product / vendor.

🆕 Fraunhofer FKIE NVD Feeder

FKIE NVD Feeder is now operating as a standalone source. (b1e86d8)

🆕 Sightings Import/Export

Manage your sightings via the admin interface with new import/export capabilities. (23cfed2)

🆕 New API Endpoint

Quickly retrieve recently added or updated vulnerabilities since a specific date for better automation and integration. (eccd34d)

🛠️ Changes

• Harmonized pagination mechanism of the API and made it more simple to use (using page numbers instead of using offsets) (46ce344)
• The evolution chart is now taking advantage of the pagination in order to get more data (ada62e2)
• Added an input integer slider in order to let the user dynamically set the minimum number of sightings in the evolution table (cea65b7)
• Implemented a function to check if a domain name exists in the block list, as defined in the website's configuration file (a2e04b3)
• Various improvements to the home page (48cbaed)
• log entry when a shutdown key is present on start (fd18d45)
• Various improvements to the API

📂 To see the full rundown of the changes, users can visit the changelog on GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v2.5.0

🙏 Thank you very much to all the contributors and testers!

Tips

Filtering your email notifications

Notification emails from Vulnerability-Lookup include custom SMTP headers:

• X-Mailer: Vulnerability-Lookup
• X-Category: Security Advisory

This allows you to easily create rules or filters in your email client, as shown below. Additionally, you can set up more fine-grained rules based on the email subject.

[]

Creation of a new notification

Example of a notification with sightings

for readers missing the significance of the number 4 in the proof of concept: to demonstrate this vulnerability the researchers created a microcode update which replaces the "hardware" random number generator behind the RDRAND instruction with an implementation of xkcd#221 😭

We are glad to announce the immediate availability of vulnerability-related observations from The Shadowserver Foundation within Vulnerability-Lookup.

This milestone wouldn’t have been possible without Piotr Kijewski. We developed a new sighting client, ShadowSight. This new client gathers vulnerability-related data directly from The Shadowserver Foundation, then reports the collected data to the Vulnerability-Lookup API as sightings.

ShadowSight leverages insights on common vulnerabilities and exploited vulnerabilities from Shadowserver’s honeypot source. Source code of ShadowSight is available:

👉 https://github.com/CIRCL/ShadowSight

Explore our sightings collected from this source:

• Exploited vulnerabilities (type: exploited):
  https://vulnerability.circl.lu/sightings/?query=honeypot%2Fexploited-vulnerabilities
• Common vulnerabilities (type: seen):
  https://vulnerability.circl.lu/sightings/?query=honeypot%2Fcommon-vulnerabilities

The Shadowserver Foundation remains a cornerstone resource for security researchers, providing an extensive wealth of data on real-world exploits and their associated vulnerabilities, complete with daily statistics and geographical insights.

Widely used by incident response teams, security researchers, analysts, and other cybersecurity professionals, Shadowserver is recognized as a highly credible and impactful project in the cybersecurity landscape. The Shadowserver Foundation delivers particularly valuable insights into security issues, including vulnerabilities in unpatched IoT devices, various types of internet-facing services, and even services that should not be exposed to the internet.

For us, it has quickly become a reliable sources for sightings. It's also a way to diversify our sources and improve situational awareness.

🔗 Explore all our sighting sources (such as Mastodon, Bluesky, MISP, etc.) and tools here:

👉 https://www.vulnerability-lookup.org/tools/#sightings

📖 References

• https://www.shadowserver.org/
• https://vulnerability.circl.lu/
• https://github.com/cve-search/vulnerability-lookup
• https://github.com/CIRCL/ShadowSight
• https://www.vulnerability-lookup.org/documentation/sightings.html

🤝 Contribute

If you want to benefit from more features of Vulnerability-Lookup like sharing comments, bundles, or sightings, you can create an account to the instance operated by CIRCL:

👉 https://vulnerability.circl.lu/user/signup

We’re really thrilled to unveil Vulnerability-Lookup 2.4.0!

https://www.vulnerability-lookup.org/images/news/2025/2025-01-10-Vulnerability-Lookup-2.4.0.webm

This version includes new features, new importers, improvements and fixes. The key updates are highlighted below.

🔍 New Dashboard: Quickly access the top sighted vulnerabilities from the past month with a real-time, filterable interface.

📊 New Correlations Graph: Visualize relationships between sightings for deeper insights.

📥 New Importers:

• CSAF Microsoft Importer for streamlined CSAF data integration.
• FKIE NVD Importer to incorporate FKIE NVD datasets seamlessly.

📡 RSS/Atom Feeds for Sightings: Stay updated with feeds for specific CPE sightings, sorted and tailored for your needs.

👀 GitHub Gist Sighting Tool: Introducing GistSight for tracking vulnerabilities in GitHub Gists.

💡 Other Updates: We’ve added metadata enrichment capabilities and made significant API improvements to enhance your experience.

Discover more about Vulnerability-Lookup and its capabilities here:
https://vulnerability.circl.lu/

🙏 Thank you very much to all the contributors and testers!

To see the full rundown of the changes, users can visit the changelog on GitHub: https://github.com/cve-search/vulnerability-lookup/releases/tag/v2.4.0

Curious about the latest vulnerability trends, the year's first observations, or historical insights? Our enhanced home page on Vulnerability-Lookup (source code) now lets you filter and explore our growing dataset of sightings with ease. Simply pick the week you want and dive into the data.

Have ideas for improvements? Let us know! https://github.com/cve-search/vulnerability-lookup/issues

Of course you get these sightings via the API: https://vulnerability.circl.lu/api/

You can find various collected status here: https://vulnerability.circl.lu/sightings/?query=bsky.app

Amnesty International identified how Serbian authorities used Cellebrite to exploit a zero-day vulnerability (a software flaw which is not known to the original software developer and for which a software fix is not available) in Android devices to gain privileged access to an environmental activist’s phone. The vulnerability, identified in collaboration with security researchers at Google Project Zero and Threat Analysis Group, affected millions of Android devices worldwide that use the popular Qualcomm chipsets. An update fixing the security issue was released in the October 2024 Qualcomm Security Bulletin.

Our longstanding offering won’t fundamentally change next year, but we are going to introduce a new offering that’s a big shift from anything we’ve done before - short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.

I store my mechanically generated passwords in 1Password. And I do not use the password in any way.

In such a case, does it make sense to activate TOTP? In my immature opinion, TOTP is only effective if you are using the same password for multiple websites. If this is incorrect, could you please tell me when TOTP would be useful?

We’re delighted to announce the release of Vulnerability-Lookup 2.2.0, packed with enhancements, new features, and bug fixes.

What's New

• Identity:

  • Vulnerability-Lookup now has a beautiful new logo.

• New Statistics Namespace: The API now offers a dedicated namespace for statistics. Two new endpoints are currently available:

  • /api/stats/vulnerability/most_sighted
  • /api/stats/vulnerability/most_commented Both endpoints provide the option to return results in a Markdown table format. (7a2b8ed, d95b49c)

  You can use the API output directly to generate PDF reports:

  $ curl -s -X 'GET' 'https://vulnerability.circl.lu/api/stats/vulnerability/most_sighted?date_from=2024-07-01&output=markdown' | pandoc --from=markdown --to=pdf -o semestrial-report.pdf
  

• New Client for KEV Sightings: A new Python client, KevSight, is available to generate sightings for Vulnerability-Lookup using the Known Exploited Vulnerabilities (KEV) catalog. For more details, refer to the Vulnerability-Lookup documentation on sightings automation and the available clients.

Changes

• API Enhancements:

  • Numerous improvements and harmonization across the API while maintaining compatibility with previous versions. PyVulVulnerabilityLookup has been updated. (f9a03fb, 79cc46d)

• Improved Views:

  • /recent: Enhanced for greater consistency and readability.
  • /vuln: Improved display for vulnerabilities from the CVE List v5 and NVD sources. The versions of the impacted products is now displayed in a third column. (9308772, 5f9826a, f71da45, 54ad96e, e8ae16e)
  • We have enhanced the layout and accessibility of various views as part of our ongoing commitment to creating software that is inclusive and usable for everyone.

• Documentation:

  • The documentation is now exposed by a dedicated Flask Blueprint which is serving static HTML files generated with Sphinx. Updating the documentation is possible via a simple button in the dashboard of Vulnerability-Lookup. (e27ac9f, 6f38ccf)

• Backend:

  • Harmonization of datetime objects by ensuring that all dates use UTC-aware timestamps (8ea2554, a4defc2)
  • Gunicorn is now by default using Gevent (c79f997)

Fixes

• Date Parameters in API:

  • The date_from and date_to parameters in the API no longer have default values. It is now the client’s responsibility to specify these values. (036ca3a)

• CVE Lookup Endpoint:

  • We fixed the API endpoint for searching CVEs by vendor and product. (0867fac)

Funding

The NGSOTI project is dedicated to training the next generation of Security Operation Center (SOC) operators, focusing on the human aspect of cybersecurity. It underscores the significance of providing SOC operators with the necessary skills and open-source tools to address challenges such as detection engineering, incident response, and threat intelligence analysis. Involving key partners such as CIRCL, Restena, Tenzir, and the University of Luxembourg, the project aims to establish a real operational infrastructure for practical training. This initiative integrates academic curricula with industry insights, offering hands-on experience in cyber ranges.

vulnerability-lookup is co-funded by CIRCL and by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or ECCC. Neither the European Union nor the granting authority can be held responsible for them.

https://archive.is/JTLIU

I am looking for active Lemmy accounts about software vulnerabilities, CVEs, etc. It could be specific to GHSA, CSAF, PySEC, GSD, Pypi or whatever.

I will use it in a software vulnerability lookup projects: https://github.com/cve-search/vulnerability-lookup/ in order to create Sightings about vulnerabilities.

(it's fine as well if you can provide me Mastodon accounts. I already follow CVE program)

thank you !

hi everyone!! i need ur help with a security matter!! pardon me my bad English. It's my first time buying online I wanna buy something from eBay with my bank card but eBay doesn't provide 3d security which is another layer of security I'm afraid that my personal might get leaked if i used it like that and i don't wanna open a PayPal account since I'm only using this once plus PayPal fees and deductions are high for someone like me and the extra custom charges are already taking a lot of my money that i was planning to buy other things!! what to do know???????? google wallet? deactivating e-commerce international payment after I'm done purchasing ??? pls help me and thank you! btw this is why crypto should take over!!! 🥹😓

here is the talk description, from its page on the schedule for KubeCon + CloudNativeCon + Open Source Summit China 2024 (which Linux Foundation somehow neglected to put in their youtube upload's description):

In Febuary the Linux kernel community took charge of issuing CVEs for any found vulnerability in their codebase. By doing this, they took away the ability for any random company to assign CVEs in order to make their engineering processes run smoother, and instead have set up a structure for everyone to participate equally.

This talk will go into how the Linux CVE team works, how CVEs are assigned, and how you can properly handle the huge number of new CVEs happening in a simple and secure way.

今年二月，Linux内核社区开始负责为其代码库中发现的任何漏洞发布CVE编号。通过这样做，他们剥夺了任何随机公司分配 CVE 的能力，以便使他们的工程流程更顺畅，取而代之的是建立了一个人人平等参与的结构。

本次演讲将介绍 Linux CVE 团队的工作方式，CVE 的分配过程，以及如何以简单且安全的方式妥善处理大量新出现的 CVE。

Here is a PDF of the slides from Greg's git repo for this talk.