Vulnerability-Lookup now ingests Red Hat's per-CVE CSAF VEX documents and attaches them straight to the vulnerabilities you're already tracking. Which products are affected? Which are fixed? Which were never affected at all? One glance at the new VEX tab — or the EPSS-style VEX badge right in the vulnerability header — and you know.

No more digging through vendor advisories to answer "does this CVE actually matter to us?" 🔎

Also in this release:

✅ New /api/vex endpoints — VEX data, fully machine-readable 🔐 Per-user enable/disable of CNA publication, with a dedicated admin overview 📬 Admin overview for KEV catalog e-mail subscriptions + richer digest e-mails (entry titles, affected vendors & products) 🛠️ A batch of feeder robustness fixes — no more full re-imports or notification storms after a partial download failure

Vulnerability-Lookup is open source, and you can run your own instance today (https://www.vulnerability-lookup.org/documentation/installation.html).

👉 Release post: https://www.vulnerability-lookup.org/2026/07/10/vulnerability-lookup-5-4-0/

⭐ GitHub: https://github.com/vulnerability-lookup/vulnerability-lookup

Feel free to create an account on the instance operated by CIRCL: 👉 https://vulnerability.circl.lu/user/signup

📚 References

Source code: https://github.com/vulnerability-lookup/vulnerability-lookup

Examples:

• https://vulnerability.circl.lu/vuln/CVE-2026-1207#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-53359#vex
• https://vulnerability.circl.lu/vuln/CVE-2026-4631#vex
• https://vulnerability.circl.lu/vuln/CVE-2023-39361#vex

💶🇪🇺 Funding

Vulnerability-Lookup is co-funded by CIRCL and by the European Union through the #NGSOTI project.

More information from the Restena Foundation: https://www.restena.lu/en/project/ngsoti

#VulnerabilityManagement #VEX #CSAF #CVE #OpenSource #CyberSecurity #ThreatIntelligence