Edit ndaal-sa-2026-039

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

nvulnlookup v0.1.41 corrects a column-rendering regression on the vendor-dashboard recent-25 tables for every dashboard whose feeder ships CVE 5.0 documents (vulnrichment, cvelistv5, ubuntu, rust). Releases v0.1.36 through v0.1.40 rendered the CVE-ID column correctly but left the Severity, Published, and Title columns blank because the helper functions in `crates/vl-web/src/routes/vendor_dashboard.rs` (`extract_title`, `extract_severity`, `extract_published`) only walked legacy CSAF `/document/...` and OSV `severity[]` paths.  The CVE 5.0 schema places the same fields under `/containers/cna/...` and `/cveMetadata/...` — paths the dashboard helpers had no knowledge of.  The per-vulnerability detail page at `/vulnerability/<id>` rendered correctly because its helpers in `routes/home.rs` walked the CVE 5.0 paths.  The defect was a write-through case of code duplication: an earlier release (v0.1.36 cycle) added CVE 5.0 awareness to `routes/home.rs` only, leaving `routes/vendor_dashboard.rs` behind.  v0.1.41 introduces a shared `crates/vl-web/src/routes/cve5.rs` module that both call sites delegate to, removing the divergence and restoring the recent-25 columns on every CVE-5.0-shaped dashboard.

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel