Vulnerability Lookup

The talk introduces Vulnerability Lookup, a newer open source project led by CIRCL and co-funded by the European Union. The presenter explains that it grew out of CVE Search, a tool first built for internal use that now handles very heavy query traffic from many organisations. Diversifying vulnerability sources, each with its own format, was a key motivation for the redesign.

The presenter walks through the supported sources, which include GitHub advisories, CSAF feeds, and other vendor and national feeds, and notes that all collected data is exported as open data. Core features include a fast lookup API documented with Swagger that needs no token, the ability to run synchronised local instances for private distribution inside an organisation, and early support for EPSS scores. Users can also follow results through RSS and Atom feeds.

The later part covers community features. Registered users can add comments, apply taxonomy tags, group vulnerabilities into bundles, and record sightings such as exploitation or patching. A short live demonstration showed the web interface, including dashboard charts built from community sightings. The takeaway is that the project depends on contributors adding remediation context and proof-of-concept information.