Edit ndaal-sa-2026-038

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

nvulnlookup v0.1.40 corrects a data-source defect in the EPSS/KEV enrichment feeder (`crates/vl-feeders/src/feeders/epss_kev_enrichment.rs`).  Releases v0.1.0 through v0.1.39 fetched a community-maintained GitHub CSV (`https://raw.githubusercontent.com/jgamblin/KEV_EPSS/main/epss_kev_nvd.csv`) that pre-joins the CISA Known Exploited Vulnerabilities catalog with the EPSS scores for THAT specific subset — i.e. roughly 1,200 CVE rows out of the ~300,000+ CVEs that have an EPSS score in the official FIRST.org bulk dataset.  Net effect on a v0.1.39 production deployment: the `ENRICHMENT_EPSS_KEV` redb table was populated with EPSS data for only the ~1,200 KEV-listed CVEs, and every imported row was hard-coded with `kev: true` regardless of whether the CVE was actually on the CISA KEV catalog.  v0.1.40 switches to the official FIRST.org bulk dataset (`https://epss.cyentia.com/epss_scores-current.csv.gz`, gzipped, daily refresh, ~300,000+ entries) and cross-references each row against a freshly fetched CISA KEV catalog (`https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json`) so `kev: true` is set if and only if the CVE is on the KEV list.  Net effect on a v0.1.40 fresh run: the enrichment table grows from ~1,200 rows to ~300,000+ rows, and the `kev` flag accurately reflects CISA KEV membership.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel