About Vulnerability-Lookup

nvulnlookup

Version 1.2.69

Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure (CVD).

Features

• Aggregate vulnerability data from multiple authoritative sources
• Correlate advisories across different ID schemes (CVE, GHSA, PYSEC, etc.)
• Full-text search via Meilisearch integration
• REST API for programmatic access (HATEOAS)
• RSS and Atom feeds for monitoring
• Coordinated Vulnerability Disclosure (CVD) support

Security

rust-doctor Analysis Results

• Pure Rust, no OpenSSL dependency (rustls only)
• TLS 1.3 enforced, no TLS 1.2 fallback
• Clickjacking & MIME-sniffing blocked (X-Frame-Options: DENY, CSP frame-ancestors 'none', X-Content-Type-Options: nosniff)
• HSTS 2-year max-age with includeSubDomains; preload
• Cross-origin isolation (COOP + CORP + COEP)
• 0 SQL injection vulnerabilities (SQLMap + 16 manual payloads)
• 159 cargo-fuzz targets across vl-core (54), vl-web (47), and vl-feeders (58) — plus 152 honggfuzz and 124 test-fuzz targets over the same single-source fuzz-harness: three engines, one body per target. Newest targets smoke-run 60s each, 0 panics
• cargo-audit: 0 vulnerabilities across 604 dependencies (2 open informational warnings: RUSTSEC-2026-0246 sevenz-rust unmaintained, RUSTSEC-2026-0253 lru unsound via tantivy)
• Single-version dep tree: cargo tree -i block-buffer reports one version (sha2 pinned to 0.10 to share digest 0.10 with argon2/ed25519/hmac)
• CSAF 2.1: 41 published ndaal advisories, each with .sha-256 + .sha-512 + .sha3-512 sidecars
• Dedicated multi-thread runtime for the feeder scheduler (v0.1.42): HTTP request handlers no longer starve under feeder load (cf. ndaal-sa-2026-041)
• Nuclei DAST re-scan v0.1.32: 0 real findings (6 remaining are catalogued FPs in CSAF 018)

Comparison

Original Vulnerability-Lookup by CIRCL vs nvulnlookup by ndaal (Pierre Gronau)