This release asks a question we had not asked before: how good are the actors of the vulnerability ecosystem at what they publish?

Two new scorecards answer it:

👉 The KEV catalogue scorecard grades the known-exploited-vulnerability catalogues (CIRCL, Cybersecurity and Infrastructure Security Agency, European Union Agency for Cybersecurity (ENISA), The Shadowserver Foundation, Previdian) on four pillars: how well a claim is backed, how well it is situated, how early it came, and whether the catalogue is maintained. Evidence is weighed by where it comes from, and mirrors are inferred from the data, so a copy of another catalogue is not an independent witness.

👉 The CNA and GNA scorecard grades the assigners on thirteen published rules over their records: description, scope, severity, action. Every CVE and GCVE page now shows the grade of its assigner.

Image

Image

Image

This release as well introduces new visualisations for the stats page (vulnerability.circl.lu/stats/#stats-composition) and for the sightings (a new correlation graph: vulnerability.circl.lu/vuln/CVE-2026-19478#sighti…).

Image

Image

🆕 Also new:

  • A vulnerability timeline laying out everything dated we hold on a record: publication, KEV listings, advisories, sightings, day by day. Thanks to Alexandre Dulaunoy
  • Sighting correlation graphs redrawn with Pivotick thanks to Sami Mokaddem.
  • GCVE-EU BCP-05-X-03, the handling and disclosure timeline extension, read and rendered, with its exploitation events checked against the catalogues and the sightings we hold.- An audit history for CNA publications.
  • A corrected exploit hazard model for young vulnerabilities thanks to Laura Cristiana Voicu

📢 The full announcement, with screenshots and upgrade notes: vulnerability-lookup.org/…/vulnerability-lookup-6…

Thanks to everyone who contributed to this release. 🙏

As usual, feel free to create an account on the instance operated by CIRCL (Computer Incident Response Center Luxembourg):

👉 vulnerability.circl.lu

👋 Come meet us next week at hack.lu: 2026.hack.lu/info/

We were also present at Vulnopticon 2026. Presentation materials are now available: gcve.eu/2026/09/28/gcve-at-vulnopticon-2026/

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL (Computer Incident Response Center Luxembourg) and by the European Union through the #NGSOTI project.

#VulnerabilityLookup #VulnerabilityManagement #OpenSource #GCVE #CVE #KEV #CTI