Vulnerability-Lookup 6.0.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.0.0!

This release is centred on two themes. Notifications leave the e-mail-only world: a subscription can now push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — with a configurable payload, under a strict outbound policy. And the local exploit hazard model moves from an experiment to a first-class citizen of the platform: two new API endpoints, hazard-ordered reports, per-subscription parameters and daily standing exposure alerts. On top of that: a vulnerability credits index with rankings and search, SSVC v2.0 decisions on the CVE page, an import_dump command to bootstrap an instance from the public dumps, and a batch of security fixes.

What’s New

Webhook notifications

Product notifications are no longer e-mail only. A subscription can deliver its reports to an HTTPS endpoint instead of, or in addition to, e-mail (#525, #540). The delivery is configurable — HTTP method, custom headers, and a payload template whose string values accept {vendor}, {product}, {vulnerability_ids}, {hazard_events_per_day} and other placeholders — so the same mechanism feeds a generic JSON collector or the specific shape expected by Mattermost, Microsoft Teams, DingTalk, Telegram or an automation platform. Delivery state is tracked per channel, so a failing webhook never causes the e-mail to be re-sent.

The notification edit form with the delivery mode set to Email and webhook, showing the webhook URL, HTTP method, custom headers and payload template fields

A subscription delivering via e-mail and webhook: target URL, HTTP method, custom headers and an optional payload template.

Targets are held to a strict outbound policy, enforced when the form is saved and again at delivery time: HTTPS on a standard port, no redirects, delivery pinned to the validated IP address, and private, loopback and link-local addresses refused — IPv6 transition addresses being judged by their embedded IPv4 destination, as introduced in 5.5.1. URL-shortener and dynamic-DNS domains are rejected through the MISP warning lists, and URL paths are redacted from the failure logs. A malformed payload template can no longer break a delivery.

Local exploit hazard, as an API

The local exploit hazard model (arXiv:2607.24618) gets a new implementation that turns an EPSS forecast into an exploitation risk estimate accounting for your environment: compensating controls (globally or per attack vector), KEV policy weighting, and an exponential or KEV-calibrated Weibull age decay (#530).

POST /api/exploit-hazard computes it for a single vulnerability instance — resolved from a vulnerability id, using the instance’s own EPSS and CVSS metadata, or from explicit values. POST /api/exploit-hazard/batch aggregates a whole exposed set (up to 256 instances) into the aggregate daily hazard, the expected number of exploitation events over the horizon and the Poisson probability of at least one event, following section 3.6 of the paper.

Hazard-aware reports and standing exposure alerts

The same model now drives the notifications themselves. E-mail and webhook reports order the vulnerabilities by their individual hazard, annotate each one with its EPSS score, age and horizon exploitation probability, and carry the batch aggregate for the report as a whole.

An hourly notification e-mail for fortinet / fortios opening with an Exploitation hazard estimate section, then the vulnerabilities annotated with their 7-day exploitation probability, EPSS score and age

A notification report: the aggregate estimate for the report, the standing exposure of the subscription, and vulnerabilities ordered by their individual hazard.

Each subscription can localize the estimates with its own hazard parameters — control effectiveness, per-attack-vector controls, KEV policy, Weibull shape — configured on the restructured notification form. Vulnerabilities listed in the local KEV catalog activate the KEV policy automatically.

The Exploitation hazard settings section of the notification form, with a JSON parameters field containing controls, controls_by_attack_vector, kev_weight and kev_floor, and an exposure alert threshold field

Per-subscription hazard parameters: global and per-attack-vector controls, KEV weighting, age-decay shape — and the exposure alert threshold.

Beyond the per-report delta, the daemon evaluates the standing exposure of each subscription once a day — the aggregate hazard of the entire vulnerability set it watches — and alerts on upward crossings of a subscriber-defined threshold. The alert lists the top hazard contributors, i.e. the remediations that lower the exposure most (section 3.7 of the paper).

An exploitation hazard threshold crossing alert for linux / linux, giving the current exposure across 13476 scored vulnerabilities and listing the top contributing CVEs with their events per day

A standing exposure alert: the current aggregate exposure, and the vulnerabilities whose remediation would lower it most.

The evaluation is built for scale: pipelined EPSS reads, a week-long cache of the record-derived inputs with a bounded refill per run, and shared computation across subscriptions watching the same product with the same parameters.

Vulnerability credits index and rankings

The feeders now index the credited researchers of CVE 5, OSSF and CSAF records, and a new /credits/ page ranks them (#539), with year and month filters, a sort toggle, server-side pagination and a case-insensitive search over the credit names.

The Vulnerability Credits page listing 26917 credited people and organizations, ranked by their number of advisories, with a search field and a sort toggle

The new credits page: every credited person and organization, ranked by the number of advisories crediting them.

The credit badges on the vulnerability page link into that search, so a name seen on one advisory pivots to every advisory crediting it. The statistics page and /api/stats expose the ranking too.

The statistics page with a new Top 10 Credits chart for the current month, next to the Top 10 Most Common CWE chart, with a Browse vulnerability credits button

The credits ranking on the statistics page, alongside the other monthly indicators.

SSVC v2.0 decisions visualized in CVE records

SSVC decision points are extracted from every container of a CVE 5 record (CNA and ADPs), normalized across the three shapes found in the wild, deduplicated and attributed to the container that published them (#546).

The vulnerability page for CVE-2026-61937 with a new SSVC row showing the Exploitation, Automatable and Technical Impact decision points, attributed to CISA Coordinator via the CISA-ADP container

SSVC decision points on the vulnerability page, attributed to the container that published them.

Bootstrap an instance from NDJSON dumps

A new import_dump command loads the public Vulnerability-Lookup dumps into a fresh instance (#519). This is a one-time bootstrap only — it is not a synchronization mechanism, and every operator surface says so. Exports are annotated with the key type and score, so the importer restores hash-typed metadata as Redis hashes and sorted-set scores faithfully; skipped documents are a full no-op, and feeder cursors are never written into last_updates.

EUVD: KEV linking and EPSS index

KEV (exploited) catalog linking for EUVD records, and a score-ordered EPSS index that turns EPSS filtering into a single lookup, with a production write path and safe resolution for the KEV projection. Contributed by @archakisn in #515 and #518.

Governance documentation

Project governance, the maintainer list, the roadmap and the privacy documentation are now published in the repository and on the documentation site (#553).

Changes

  • Website — Charts is the default dashboard tab when no cookie is set.
  • Documentation — Linked the Mapping CVEs to MITRE ATT&CK Techniques paper from the ATT&CK tab, documented the deployment network exposure and transport hardening of the web service, and updated the CSAF downloader version in the example.
  • CI — The Tests workflow runs the whole pytest suite; the test cache is started with CLI flags instead of a config file, and the suite is order-independent.
  • Typing — Make Mypy Happy Again.
  • Dependencies — Updated Python dependencies, and made gevent a direct dependency so the lock file keeps it (it is an extra of gunicorn, which dependabot regenerations dropped).

Security

  • Reference tags are escaped in render_tag_badges, and the markdown filter escapes its fallback output (XSS-VULN-01).
  • The SSE stream is gated on an active and confirmed account (AUTH-VULN-01).
  • Account activation and recovery tokens are single-use (AUTH-VULN-02).
  • The outbound-URL policy is enforced on remote-instance synchronization (SSRF-VULN-01).
  • Authenticated responses are kept out of shared caches, so a reverse proxy cannot serve one user’s page to another.

Fixes

  • Models — Single-digit PYSEC sequence numbers are accepted.
  • User — Disclosure links are guarded when the vulnerability_disclosure module is disabled.

Changelog

📂 For the full list of changes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v6.0.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/