Vulnerability-Lookup 5.5.0 released

We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.

What’s New

Role-Based Access Control

The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.

The Roles admin page listing regular roles (admin, automation, commenter, reporter) with their scope, permission and user counts, and the creation policy roles assigned automatically when users create resources

The new Roles admin page: regular roles assignable globally or per resource, and creation policy roles granted automatically when a user creates a resource.

Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, …) that can be edited from the admin interface:

The role edit page with the scoped resource type selection and the permission checkboxes grouped by resource: admin, bundle, cna_publication, comment, kev

Editing a role: pick the resource types the role can be scoped to and the exact permissions it grants.

The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.

AI-suggested MITRE ATT&CK techniques

The vulnerability details page gains a new ATT&CK tab with MITRE ATT&CK techniques suggested by our new AI model, trained with VulnTrain and published as CIRCL/vulnerability-attack-technique-classification-roberta-base on Hugging Face.

A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.

The approach behind this classifier is described in our paper on mapping CVEs to MITRE ATT&CK techniques.

The new ATT&CK tab on the vulnerability page for CVE-2021-44077, listing AI-suggested techniques such as T1133 External Remote Services and T1190 Exploit Public-Facing Application with their confidence scores

The new ATT&CK tab: MITRE ATT&CK techniques inferred from the vulnerability description, with confidence scores and a link to the exact model revision.

EUVD ID allocation and creation pipeline

The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.

Feeder supervision and CSAF resilience

feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.

The Processes admin page showing the heartbeats of the running processes, with stale heartbeats highlighted in yellow, and the recent process logs below

The Processes admin page: process heartbeats — stale ones highlighted — and the recent process logs.

More VEX enrichment sources and a VEX records UI

New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).

New feeders: Rocky Linux, Ubuntu and TuxCare

New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.

Profile photo and improved public profile

Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.

Changes

  • Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.

    The admin dashboard with the new full-height sidebar grouping the pages by mission: access, moderation, catalog, notifications and system

    The redesigned admin interface: a full-height sidebar grouped by mission replaces the navbar dropdown.

  • CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.

  • Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).

  • Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).

  • Documentation — Listed the recently merged feeders in the README and fixed the source gaps.

  • Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.

Fixes

  • Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
  • Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API’s failures on large limits.
  • Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
  • Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
  • Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v5.5.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/