We are pleased to announce the release of Vulnerability-Lookup 5.5.0!

This is a big one. The legacy admin flags give way to full Role-Based Access Control: roles, permissions, global and per-resource assignments, creation policies and dedicated management UIs, enforced across the views and the APIs. The vulnerability page gains AI-suggested MITRE ATT&CK techniques, inferred from the vulnerability description by a model trained with VulnTrain. On top of that: an EUVD ID allocation and creation pipeline, feeder supervision with automatic respawning and CSAF backoff, new VEX enrichment sources (SUSE and Microsoft MSRC) with a VEX records browse view, new feeders for Rocky Linux, Ubuntu and TuxCare, and a redesigned admin interface.

What's New

Role-Based Access Control

The boolean admin flags of previous versions are replaced by a full RBAC mechanism: roles and permissions in a unified data model, role assignments with global or per-resource scope, creation policies that automatically grant the creator role when a resource is created, and a configurable default role for self-registration. Permission checks are enforced across the views, the templates and the user, system, KEV, CNA, bundle and sightings APIs. Contributed by @NMD03 in #497.

Each role is a set of fine-grained permissions (bundle:create, cna_publication:publish, kev:modify, ...) that can be edited from the admin interface:

The release also ships the hardening and migration work that followed the initial review: three security gaps around account confirmation and admin lockout were closed, permission checks keep working on a closed session, the creator role assignment is atomic with resource creation, owner role assignments are backfilled for pre-existing resources, the seeding is non-destructive and runs on update, role assignments are no longer bulk-loaded on every request, and the scoped-assignment tables are paginated. A permission-matrix test suite locks the behavior in, and the migration path for existing instances is documented — existing users and their resources are migrated automatically.

AI-suggested MITRE ATT&CK techniques

The vulnerability details page gains a new ATT&CK tab with MITRE ATT&CK techniques suggested by our new AI model, trained with VulnTrain and published as CIRCL/vulnerability-attack-technique-classification-roberta-base on Hugging Face.

A new POST /api/vlai/attack-techniques endpoint proxies the ML-Gateway /classify/attack-techniques service with strict validation of the gateway response. The suggestions are lazy-loaded from the vulnerability description and clearly labelled as AI-generated, with a link to the model card and the exact model revision; gateway, model or network errors are shown to the user and allow a retry.

The approach behind this classifier is described in our paper on mapping CVEs to MITRE ATT&CK techniques.

EUVD ID allocation and creation pipeline

The EUVD support keeps progressing: a per-year EUVD ID allocator with a one-EUVD-per-CVE guarantee, an EnisaID creation pipeline that mints EUVD IDs for published CVEs, bidirectional vendor/product/advisory relationship sets, EUVD search with sort indexes and CVSS/EPSS/date filtering, a source and assigner registry with an assigner filter index, and advisory, vendor/product and CSAF advisory links wired into EUVD creation. Contributed by @archakisn in #475, #476, #479, #480, #488, #489, #491, #498, #499, #500, #501, #502, #503, #509 and #511.

Feeder supervision and CSAF resilience

feeders_manager now watches the feeders and respawns the dead ones, and CSAF sources are suspended with exponential backoff after fully failed cycles (#508, closing #459 and #463). CSAF import memory is bounded — untouched files are skipped and batches flushed on size — while unparseable files stay retryable, the watcher survives launch failures and transient cache errors, and the runtime script_name is aligned with modules.cfg so --stop actually stops the feeders.

More VEX enrichment sources and a VEX records UI

New SUSE CSAF VEX (#483) and Microsoft MSRC CSAF VEX (#469) metadata feeders join the Red Hat one introduced in 5.4.0. A new VEX records browse view allows pivoting from VEX documents to the corresponding CVEs, with index-level paging and input validation (#473).

New feeders: Rocky Linux, Ubuntu and TuxCare

New sources join the platform: Rocky Linux OSV (#482), Ubuntu USN (OSV) and TuxCare CSAF (#487), wired into the web interface and the README.

Profile photo and improved public profile

Users can now upload a profile photo, with Gravatar as fallback (#496). The public profile page was improved: stat tiles and profile links point to the author-filtered public pages, and the header stacks on small screens.

Changes

• Admin — Admin interface redesign: the navbar Admin dropdown is replaced by a full-height sidebar on the admin pages, grouped by mission with an RBAC sub-navigation and a user menu at the bottom. The Maintenance card moved to a dedicated page, the user list can be filtered by role (with role user counts linking to it), breadcrumbs were dropped and the page headings harmonized.
  
• CWE — Modernized the CWE views: singular /cwe endpoint (with 301 redirects from the legacy paths), vex-style browse list and harmonized detail page; /api/cwe/ can now filter out Discouraged and Prohibited CWEs.
• Sync — Sturdier synchronization of large backfills: pages are streamed with bounded transactions, transient page failures are retried and last_sync is kept on incomplete runs, JSON decode errors are caught per page, and the sightings page size was lowered (#492, #494, #495).
• Feeders — The Red Hat VEX feeder uses the canonical CSAF metadata URL, and csaf_tibco is disabled by default (the endpoint returns 403).
• Documentation — Listed the recently merged feeders in the README and fixed the source gaps.
• Dependencies — Updated Python dependencies (including cryptography 48.0.1 via gcve 0.12.1) and bumped the pinned CodeQL actions.

Fixes

• Feeders — The cvelistv5 vendor/product indexes converge on the shared CNA+ADP helper, and containers.adp is iterated as a list so the adp:shortName:* indexes are actually populated.
• Feeders — The VARIoT feeder paginates its imports itself with small pages, instead of tripping the API's failures on large limits.
• Feeders — The Rocky Linux OSV feeder walks all Apollo pages and dedups against the index (the Apollo API shifts records between pages), and the OSV git mirrors are synced with fetch + reset instead of pull.
• Sightings — Invalid CVE identifiers are rejected by the vulnerability id regex.
• Disclosure — Imported the names is_public_disclosure relies on and fixed test type errors.

Changelog

📂 For the full list of changes, check the GitHub release:
github.com/vulnerability-looku…

🙏 A big thank you to all contributors and testers!

Feedback and Support

If you encounter any issues or have suggestions, feel free to open a ticket on our GitHub repository:
github.com/vulnerability-looku…
Your feedback is always appreciated!

Follow Us on Fediverse/Mastodon

You can follow us on Mastodon and get real-time information about security advisories:
social.circl.lu/@vulnerability…