How we connect your vulnerabilities to official CVEs

When our system identifies a security risk, we provide detailed context by linking the issue to the global standard for vulnerability tracking: Common Vulnerabilities and Exposures (CVE).

The Linking Process

For this enrichment to work, a detected vulnerability must first contain a specific reference to a CVE ID (e.g., CVE-2023-12345). Once this reference is established, our system automatically initiates a correlation process.

Instead of relying on a single database, we cross-reference the CVE ID against a massive aggregation of external security sources, vendor bulletins, and advisory feeds. This ensures that the information you see is not just a static error code, but a comprehensive summary of the vulnerability as understood by the global security community.

National Vulnerability Databases

• NVD CVE importer (API 2.0), with Fraunhofer FKIE NVD JSON feeds

• China National Vulnerability Database (CNNVD)

• JVN iPedia – Japanese vulnerability countermeasure database

• CERT-FR Alerts and Advisories

• CISA Known Exploited Vulnerabilities Catalog

• CNW (EU CSIRTs network) Known Exploited Vulnerabilities

Community & Open Source Databases

• CVE Project – cvelist

• Cloud Security Alliance – GSD Database

• GitHub Advisory Database

• PySec Advisory Database

• OpenSSF Malicious Packages

CSAF-based Sources

• ABB

• CERT-Bund

• CISA

• Cisco

• Nozomi Networks

• Open-Xchange

• Red Hat

• Sick

• Siemens

• NCSC-NL

• Microsoft