News
From Gold Datasets to AI Agents: VulnMCP 2.0.0, ML-Gateway 1.4.0, and VulnTrain 3.2.0
Today we are releasing an entire chain at once. VulnTrain 3.2.0 turns a hand-curated gold dataset of CVE-to-ATT&CK mappings into a published multi-label classifier — with the methodology now on arXiv. ML-Gateway 1.4.0 serves that model (and its siblings) over a local REST API, hardened against real-world inputs. And VulnMCP 2.0.0 puts the whole thing — plus the Vulnerability-Lookup API, KEV catalogs, sightings, the GCVE registry, and now the CNA partners of the CVE Program — one tool call away from any MCP-capable AI agent.
August 30, 2026
Vulnerability Report - July 2026
All vulnerability reports Introduction This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.
August 14, 2026
Vulnerability-Lookup 6.0.0 released
We are pleased to announce the release of Vulnerability-Lookup 6.0.0! This release is centred on two themes. Notifications leave the e-mail-only world: a subscription can now push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — with a configurable payload, under a strict outbound policy. And the local exploit hazard model moves from an experiment to a first-class citizen of the platform: two new API endpoints, hazard-ordered reports, per-subscription parameters and daily standing exposure alerts. On top of that: a vulnerability credits index with rankings and search, SSVC v2.0 decisions on the CVE page, an import_dump command to bootstrap an instance from the public dumps, and a batch of security fixes.
August 13, 2026
From a Research Paper to Running Code: Experimenting with Local Exploit Hazard in Vulnerability-Lookup
One of the interesting characteristics of open-source security tooling is that it gives us a relatively direct path from research to experimentation. On 27 July 2026, Stephen Shaffer and Laura Voicu published the first version of Modeling Local Exploit Hazard — A Bayesian Framework for Quantifying Exploit Risk and Operational Efficiency on arXiv. The paper proposes turning global exploit-likelihood estimates such as EPSS into a local exploit hazard that can account for an organization’s controls, vulnerability age and exposure context.
August 11, 2026
Vulnerability-Lookup 5.5.0 released
We are pleased to announce the release of Vulnerability-Lookup 5.5.0! This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.
July 24, 2026
Vulnerability-Lookup 5.4.0 released
We are pleased to announce the release of Vulnerability-Lookup 5.4.0! The highlight of this release is VEX enrichment: a new feeder ingests Red Hat’s per-CVE CSAF VEX documents and attaches them to the corresponding vulnerabilities, surfaced through new /api/vex endpoints, a VEX tab on the vulnerability page and a VEX badge in the vulnerability header. Administrators gain per-user control over CNA publication with a dedicated credentials overview, the admin dashboard was modernized, and a batch of feeder robustness fixes makes the CSAF and VARIoT feeders much better behaved on partial failures.
July 10, 2026
Vulnerability-Lookup 5.3.0 released
We are pleased to announce the release of Vulnerability-Lookup 5.3.0! This release brings email subscriptions to KEV catalogs, letting you receive batched digests whenever new exploited vulnerabilities are added to a catalog you follow. Search gained the long-requested ability to filter and sort by CVSS base score, two new feeder families join the platform — the AVID (AI Vulnerability Database) feeder and a set of new CSAF vendor feeders — and the KEV catalogs page gained a whole suite of coverage visualisations. On the account side, 2FA recovery codes make account recovery safer.
July 7, 2026
Vulnerability Report - June 2026
All vulnerability reports Introduction This vulnerability report has been generated with the help of AI, using the VulnMCP tooling on top of Vulnerability-Lookup, with contributions from the platform’s community.
July 2, 2026
Vulnerability-Lookup 5.2.0 released
We are pleased to announce the release of Vulnerability-Lookup 5.2.0! This release centers on a broad interface redesign — a refreshed home page built around a hero search and a tabbed dashboard, with the shared card design language now rolled out across the rest of the application. Alongside it come new change-aware browse API endpoints that let clients poll only what actually changed, a modernized KEV catalogs experience with aggregated feeds, and a confidential notes field for vulnerability disclosures.
June 19, 2026
KEV Catalog Coverage in Vulnerability-Lookup
Vulnerability-Lookup can explore several Known Exploited Vulnerabilities (KEV) catalogs side by side — the local catalog of your instance as well as external ones such as CISA KEV, EUVD KEV and CIRCL KEV, all conforming to the GCVE BCP-07 standard. Until now you could browse each catalog on its own, but there was no easy way to compare them. The KEV catalogs page now features a Catalog Coverage matrix that does exactly that.
June 16, 2026