Skip to content

Vulnerability-Lookup 6.4.0 released

We are pleased to announce the release of Vulnerability-Lookup 6.4.0!

The vulnerability timeline now measures what it shows: time to exploit, time to patch, time unpatched, exploitation to patch and more, computed from the dated evidence the instance holds and aligned with the Vulnerability Timeline and Exposure Metrics (VTEM). The CWE catalogue moves to CWE 5.0 and its schema 8, groupings and views included. The statistics page opens with a comparison of the sources by the records they hold, and the record counts gain a currently-published basis that leaves withdrawn records out. Also in this release: a dump of the identifier correlations, a credits API, a way to switch off a KEV catalogue an instance does not import, a much lighter CERT-FR feeder, and Python 3.15 support.

Upgrade notes

  • No PostgreSQL migration this time.
  • Run a full indexing pass after upgrading: poetry run index_vulnerabilities, without --source. It writes the new currently-published counters and the per-source counters of every GNA, and deletes GNA-wide counters nothing reads any more.
  • The CWE catalogue updates itself to CWE 5.0 on the next cwec feeder cycle. CWE API clients: the unfiltered /api/cwe/ listing now also returns groupings and views (pass entry_type=Weakness for the previous scope), and a mitigation Description in the listing is a JSON array of paragraphs.
  • dump --all now also writes dumps/correlations.json, so scheduled full dumps publish it without a change.
  • Two hand edits to existing config files: point the two CERT-FR links of config/website.py to https://cert.cyber.gouv.fr/alerte/ and https://cert.cyber.gouv.fr/avis/, and disable csaf_tuxcare, whose provider metadata aborts every download (#712).
  • Instances importing csaf_suse or csaf_opensuse with csaf_redhat should run tools/fix_csaf_suse_redhat_copies.py, and instances importing FSTEC tools/fix_fstec_alias_links.py, both with the feeders stopped (a dry run first, then --yes).
  • The instance running ExploitDBSighting should run poetry run flask --app website.app retype_sightings (then --yes) and set sighting_type = "published-proof-of-concept" in the collector’s configuration.
  • The EUVD notes (status backfill, feeder shipped disabled) concern ENISA’s instance only; other operators are not affected.
  • Moving to Python 3.15? A virtualenv created by an older Poetry seeds pip 24.2, which no longer starts on 3.15 (module 'typing' has no attribute 'no_type_check_decorator'). Replace it with "$(poetry env info -p)/bin/python" -m ensurepip --upgrade, and run poetry self update so new environments get a current pip.

What’s New

Timeline durations

The Timeline tab now shows duration cards above the events, and GET /api/vulnerability/<id>/timeline returns the same figures in a new metrics object: time to exploit, disclosure to exploit, time to patch (from the report to the vendor), total time to patch (from discovery), disclosure to patch, time unpatched, exploitation to patch, vendor response time, and the time to a published proof of concept. The definitions follow the Vulnerability Timeline and Exposure Metrics (VTEM, Kouns and Price, Black Hat USA 2015) as far as public evidence allows; the metrics that need an introduction date or deployment data are listed as unavailable, with what each would need.

The page and the API share one server-side calculation, and every metric names its source events and their precision:

  • Only records that describe the requested vulnerability are calculation inputs. Correlated records of other CVEs stay on the timeline but never become its disclosure, exploitation or patch anchor.
  • Each anchor takes the earliest evidence. A vulnerability added to an advisory in a later revision is disclosed by that revision, not by the advisory’s first release.
  • Date-only inputs, and timestamps at exactly midnight UTC, are approximate; when the dates do not establish an order, the card shows the range the evidence allows instead of a nominal value.
  • KEV evidence is weighed for what it is. A first-hand first_seen_at (incident response, telemetry, honeypot, sinkhole) is an observation, a copied listing date is a report, a date copying the record’s publication time is not a listing at all, and a catalogue day with 25 listings or more is flagged as a backlog import.

The formulas, their limits and worked examples are in docs/vulnerability-timeline.md.

The Timeline tab of CVE-2021-44228 with eight duration cards: total time to patch about 4 days 5.84 hours from the discovery date to a vendor fix, disclosure to patch and time unpatched 4 days 6.84 hours, time to exploit and disclosure to exploit about 1 hour from publication to a KEV assertion, exploitation to patch about 4 days 5.84 hours, disclosure to public exploit 1 day 5.08 hours and public exploit to patch 3 days 1.75 hours, each card noting that the patch date comes from the related Red Hat advisory RHSA-2021:5094, then the line of unavailable metrics and the unfolded explanation of how durations are calculated

Log4Shell, CVE-2021-44228: exploited within the hour of its publication, a public proof of concept a day later, and a fix four days after disclosure. The patch date comes from a Red Hat advisory, and every card says that a downstream fix can be later than the upstream one.

The Timeline tab of CVE-2026-109618 with eight duration cards: total time to patch, time unpatched and time to exploit about 4 days 14.31 hours from the discovery date, disclosure to patch and disclosure to exploit about 2 hours, exploitation to patch shown as minus 1 day to plus 1 day and public exploit to patch as minus 4 hours to plus 20 hours, both with the note that the dates do not establish which came first

CVE-2026-109618: the exploitation sighting and the vendor fix fall on the same day, one of them known only to the day, so exploitation to patch reads "−1 day to +1 day" instead of a nominal 0 hours.

The Timeline tab of CVE-2026-118527 with four duration cards: time unpatched about 3 days 9.25 hours from a revision date, time to exploit and disclosure to exploit about minus 3 days from the revision date to the KEV assertion, with the note that exploitation was recorded before public disclosure and that the disclosure date is the revision of CERT-FR alert CERTFR-2026-ALE-013 that added this vulnerability, and exploitation to patch with no patch recorded

An Ivanti zero-day, CVE-2026-118527, added on 2 November to a CERT-FR alert first released in October for another CVE. The revision that added it is its disclosure, not the alert’s first release, and CISA asserted exploitation three days before it.

The Timeline tab of CVE-2025-53770 with seven duration cards: disclosure to patch and time unpatched about 10 days 17 hours from publication to the Patched since date of a catalogue, time to exploit and disclosure to exploit about 11 days 17 hours to a KEV assertion, exploitation to patch about minus 1 day with the note that patch evidence precedes exploitation, disclosure to public exploit 12 days 16.03 hours and public exploit to patch about minus 1 day 23.03 hours

SharePoint, CVE-2025-53770: the patch date is a KEV catalogue’s "Patched since" statement, a day before the catalogue asserted exploitation, so exploitation to patch is negative and the card says the patch evidence came first.

The Timeline tab of CVE-2024-1709 with six duration cards: time to exploit and disclosure to exploit 5.87 hours from publication to the first seen date, with the note that the exploitation date is the catalogue's first observation, disclosure to public exploit 3.27 hours, and time unpatched, exploitation to patch and public exploit to patch around 987 days with no patch recorded, above daily exploited sightings from the Shadowserver honeypots

ScreenConnect, CVE-2024-1709: exploited 5.87 hours after publication, an exact time taken from a catalogue’s own first observation rather than a listing date. With no fix on record, the patch cards stay open and count up to today.

The Timeline tab of CVE-2026-112192, a MISP vulnerability: two duration cards, disclosure to patch minus 20 days 1.28 hours from the publication on 2026-10-19 to the fix available on 2026-09-29, with the note that the patch was recorded before public disclosure and its source dates unfolded, pointing at the GCVE-BCP-05-X-03 timeline events of the CVE record, and time unpatched 0 hours; below, Fix developed and Fix available events from both the CVE record published by CIRCL and its GNA-1 counterpart GCVE-1-2026-20310

Coordinated disclosure as it should be, CVE-2026-112192 in MISP: the fix was available 20 days before the vulnerability was published, so it was never public and unpatched. The fix dates come from the GCVE-BCP-05-X-03 handling timeline that CIRCL publishes in both the CVE record and its GCVE-1 counterpart.

CWE 5.0

MITRE published CWE 5.0 and schema 8 on 28 October, and the importer reads both schemas now. Groupings and views are imported beside the weaknesses, entries with several submitters no longer crash the import (CWE-1461 did), and the API keeps every field of an entry. The catalogue pages gain a searchable full view, the content of groupings and views, relationships and contribution history; the mitigation cards of a vulnerability render the new content; and the CVE editor suggests the imported, non-deprecated weaknesses. Listings read per-entry summaries instead of every record. Contributed by Alexandre Dulaunoy.

Statistics

  • Comparing the sources. A bar chart at the top of /stats/ ranks the sources by the records they hold, with an expandable table of every source; a bar or a source name opens the source’s /recent page. Sources overlap, several describing the same CVE, so the counts are not additive and are not shares of a whole. Also served by GET /api/stats/vulnerability/sources. Contributed by Alexandre Dulaunoy.
  • A currently-published basis. /api/stats/vulnerability/counts?basis=state_published counts only the records that carry a publication date and are still published, the same population the severity bands count. The default basis is unchanged: a CVE published in 2017 and withdrawn in 2020 still counts in 2017. GNA sources now have their own per-period counters on both bases.
  • Withdrawn records are left out of the EUVD rankings and of the time to exploit.

The statistics work was contributed by Nikiforos Archakis for the EUVD, who also gave EUVD records their own lifecycle status.

The Sources section of the statistics page: a horizontal bar chart titled Vulnerability records held per source, all time, ranking OpenSSF Malicious Packages with 482,526 records, the CVE Program with 419,448, NVD with 419,448, FKIE NVD with 419,444, GitHub with 399,861, GSD with 335,809, CNVD with 132,625, FSTEC with 99,040, OSV Ubuntu with 73,305 and CSAF Red Hat with 49,594, then a View counts toggle, the note that sources overlap so the counts are not additive, and the API query behind the chart

The sources compared on the public instance: OpenSSF Malicious Packages holds the most records, ahead of the CVE Program, NVD and its FKIE mirror. The chart shows the 20 largest sources, the table below lists every one.

Identifier correlations dump

poetry run dump --correlations --index publishes dumps/correlations.json, which maps each vulnerability identifier to the identifiers directly linked to it across every stored source, without advisory bodies: "cve-2024-1234": ["ghsa-abcd-efgh-ijkl", "pysec-2024-1"]. It is part of dump --all. Contributed by Alexandre Dulaunoy.

And more

  • Credits API — GET /api/credit/ lists the credited people and organisations ranked by advisory count, with the filters of the /credits/ pages, and GET /api/credit/<credit> the vulnerabilities attributed to one of them.
  • KEV catalogues — KEV_CATALOGS_EXCLUDED in config/website.py hides a catalogue the instance does not import from the catalogue pages, menus, statistics and scorecard, and survives the registry refresh (#760).
  • Sightings — retype_sightings retypes stored sightings, by default the Exploit-DB entries pushed as exploited, which are published proofs of concept.
  • Software version — SHOW_SOFTWARE_VERSION = False keeps the running version out of the footer, /about/more, the configuration API and the OpenAPI document.

Changes

  • CERT-FR — The feeders fetch only new or revised advisories instead of all ~17,700 on every run, retry transient errors, and follow the move to cert.cyber.gouv.fr: an unchanged listing now costs one request. Contributed by Jeroen Trappers.
  • KEV — GET /api/kev/ and the catalogue pages fetch a page’s evidence in one query, instead of one per entry. Contributed by Jeroen Trappers.
  • CSAF — csaf_suse and csaf_opensuse leave the Red Hat advisories SUSE republishes to csaf_redhat, and FSTEC aliases are no longer cut at spaces. Contributed by Jeroen Trappers.
  • Website — The OSSF malicious package card uses the CVE card layout, and browsers draw their native scrollbars again.
  • Python — Python 3.15 is supported and tested in CI.
  • Project — A new contribution guide sets out the spirit of the project and a policy on AI-assisted contributions, and the documentation was reviewed for missing and stale content.
  • Dependencies — Updated Python and frontend dependencies, Pivotick 3.0.0 among them.

Changelog

📂 For the full list of changes, including the fixes, check the GitHub release:
https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v6.4.0

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
https://github.com/vulnerability-lookup/vulnerability-lookup/issues/
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
https://social.circl.lu/@vulnerability_lookup/