<!-- Copyright (c) 2026 Pierre Gronau, ndaal in Cologne -->
# User Guide
## Accessing the Web UI
Open your browser and navigate to:
```text
https://localhost:8080/
```
On first visit you will see a self-signed
certificate warning. Click **Advanced** then
**Proceed to localhost** to continue.
### Which port?
nvulnlookup serves the web UI and the API on
**8080** (TLS 1.3 over TCP, HTTP/1.1 +
HTTP/2). Port **8081** is the QUIC / HTTP/3
listener for the same content.
Those two numbers belong to nvulnlookup only.
On a host that also runs other ndaal
services, `8180` / `8181` is csaf-crud and
`8680` / `8681` is sbom-auditor — so
`https://localhost:8180/` is a different
application, not this one.
## Dashboards dropdown — fluid responsive layout (v0.1.45)
The Dashboards navbar menu adapts its column
count to the viewport width. No setting — open
the dropdown and the browser picks how many
columns to use based on the available space:
| Viewport (typical device) | Columns |
| --- | :---: |
| 360 px (phone portrait) | 1 |
| 768 px (tablet) | 3 |
| 1024 px (laptop) | 5 |
| 1366 px (laptop+) | 8 |
| 1600 px (display) | 9 |
| 1920 px (desktop) | 11 |
| ≥ 3840 px (4K) | 12 (capped) |
If an item you expect to see (e.g. a vendor
dashboard like Cisco, Microsoft, IBM, Red Hat,
or an OSV ecosystem like Rust, Python, Go,
npm) appears below the visible area:
1. The full list is **always present** in the
HTML — verify with
`curl -sk https://localhost:8080/ \
| grep -F '/dashboards/<slug>'`.
2. Maximise the browser window, or zoom out
(Ctrl/Cmd + minus) one notch.
3. As a UX safety belt, scroll the page — the
dropdown extends past the viewport rather
than being clipped (deliberate: clipping
was the pre-v0.1.43 bug that hid the OSV +
VulnerabilityFeed categories).
Pre-v0.1.45 the dropdown used fixed
breakpoints (1 col / 2 cols / 9 cols at
576 px and 992 px) which produced a
single-column tall list on 1366 px laptops
and an off-viewport overflow on smaller
screens. See `CHANGELOG.md` v0.1.45 entry
for the CSS rewrite details.
## Visual Tour — every page in the v0.1.42 navbar
This section walks every page reachable from the
top navigation bar and explains:
- **Navigation** — the click path from the home
page to that screen.
- **Why this page exists** — the operator
problem it solves and the data source(s)
driving it.
- **The screenshot** — captured at 1920 × 1080
in light theme against a freshly seeded
`vl-web` instance. All images live under
`documentation/graphics/light/`; a parallel
dark-theme set lives under
`documentation/graphics/dark/`. Filenames
carry no timestamp by design — Markdown links
point to stable names so a refresh updates
the image in place.
Re-capture the entire set against your own
deployment with:
```bash
bash scripts/create_screenshots_from_local_running_app.sh
```
### Top-level navigation
#### Home
**Navigation:** Click the **Vulnerability-Lookup**
brand on the top-left of every page (or visit
`/` directly).
**Why this page exists:** the canonical landing
page. Surfaces the three numbers an operator
checks first — total indexed vulnerabilities,
total Critical-severity rows, and active data
sources — plus a search bar pre-tuned for CVE
ID / keyword / Log4Shell / buffer-overflow
queries, plus the most-recent 25
vulnerabilities so a fresh visitor can see
that the indexer is alive.
#### Statistics
**Navigation:** top navbar → **Statistics**
(or `/stats`).
**Why this page exists:** raw aggregate
numbers — total CVE rows, breakdowns per
severity bucket and per source. Use this when
"how big is the index right now?" is the
question; the [Dashboard](#dashboard) renders
the same data as charts.
#### Dashboard
**Navigation:** top navbar → **Dashboards** →
**Overview** (or `/dashboard`).
**Why this page exists:** charts, not numbers —
CVE publishing rate over time, CVSS severity
distribution (3.1 / 4.0 toggle), top CNAs,
feeder activity summary. This is the page
that goes on a dashboard wall during a
SOC handover.
#### Recent
**Navigation:** top navbar → **Recent**
(or `/recent`).
**Why this page exists:** paginated list of
the most-recently-modified vulnerabilities
across every source. Filterable by source
(comma-separated) and by an `?days=N`
look-back window. This is the page on which
a vulnerability analyst starts every shift.
#### KEV
**Navigation:** top navbar → **KEV**
(or `/kev`).
**Why this page exists:** lists every entry
on the CISA Known Exploited Vulnerabilities
catalog — the gold-standard "patch this NOW"
feed. Each row links to the full advisory
plus our annotation hub for sightings and
operator notes.
### Specialised dashboards
These dashboards have custom URL shapes or
data models that don't fit the generic
`VENDOR_SPECS` template. Each one solves a
specific operator question.
#### CAPEC enrichments
**Navigation:** top navbar → **Dashboards** →
**CAPEC Enrichments** (or
`/dashboards/capec-enrichment`).
**Why this dashboard exists:** MITRE CAPEC
(Common Attack Pattern Enumeration and
Classification) maps each CWE to the
adversary techniques used to exploit it.
This dashboard joins our CWE enrichment with
the CAPEC dictionary so a defender can answer
"what attack pattern do I look for in WAF /
EDR logs given the CWE family of this CVE?"
#### GCVE enrichments
**Navigation:** top navbar → **Dashboards** →
**GCVE Enrichments** (or
`/dashboards/gcve-enrichment`).
**Why this dashboard exists:** GCVE
(Global CVE allocation) is CIRCL's GNA-aware
ID schema — a stable cross-CNA identifier
that survives MITRE re-issues and CNA
mergers. This dashboard tracks how many of
our CVEs already have a GCVE counterpart and
highlights the gaps.
#### EPSS — Exploit Prediction Scoring (since v0.1.41)
**Navigation:** top navbar → **Dashboards** →
**EPSS** (or `/dashboards/epss`).
**Why this dashboard exists:** EPSS (FIRST.org
Exploit Prediction Scoring System) gives each
CVE a 0.0–1.0 probability that it will be
exploited within 30 days. This dashboard
cross-tabs EPSS by year and by CVSS-bucket so
an operator can answer "of all the CVEs we're
NOT already patching, which carry the highest
exploitation odds?" The 10-bucket histogram
of raw EPSS probability shows where the
ecosystem's risk mass actually sits.
#### Nuclei templates (since v0.1.41)
**Navigation:** top navbar → **Dashboards** →
**Nuclei Templates** (or
`/dashboards/nuclei_templates`).
**Why this dashboard exists:** ProjectDiscovery's
[nuclei-templates](https://github.com/projectdiscovery/nuclei-templates)
repo carries thousands of fingerprintable
checks — CVE PoCs, default-credential probes,
exposure detectors. This dashboard shows
which of OUR indexed CVEs already have a
Nuclei template (so the analyst can
re-validate the finding offline) and lets the
operator download the raw YAML body in a
single JSON envelope.
The page-source rendering safety of this
dashboard is pinned by an integration test
(`crates/vl-web/tests/test_inline_script_escape.rs`):
nuclei templates frequently embed
`</script>` strings as XSS-detector
matchers, and unescaped emission of the JSON
into an inline `<script>` block would break
the browser's HTML parser.
#### KEV Ransomware (since v0.1.42)
**Navigation:** top navbar → **Dashboards** →
**KEV Ransomware** (or
`/dashboards/kev-ransomware`).
**Why this dashboard exists:** CISA periodically
flips a CVE's `knownRansomwareCampaignUse`
flag in the KEV catalog from `Unknown` to
`Known` — without a public announcement.
This silent update tells defenders the CVE is
now actively exploited by ransomware crews,
but only operators who diff the KEV daily
catch it.
[Greynoise's blog post](https://www.greynoise.io/blog/unmasking-cisas-hidden-kev-ransomware-updates)
documents how they monitor the daily diff.
Their feed plus a historical CSV bootstrap
drive this dashboard.
Sources:
[`kev-ransom-feed.rss`](https://kev.labs.greynoise.io/kev-ransom-feed.rss)
·
[`ransomware-status-changes-2025.csv`](https://info.greynoise.io/hubfs/artifacts/ransomware-status-changes-2025.csv)
#### CVE vs GitHub (since v0.1.42)
**Navigation:** top navbar → **Dashboards** →
**CVE vs GitHub** (or
`/dashboards/cve-vs-github`).
**Why this dashboard exists:** the GitHub
Advisory Database (OSV-shaped) and the
canonical CVE source (NVD / cvelistv5 /
fkie_nvd) frequently disagree on CVSS v3 base
scores. When the disagreement crosses 0.1,
this dashboard surfaces the deviation —
total count, per-severity bucket, per year.
Useful for triage when the two scoring
authorities disagree on whether something is
"High" or "Critical".
### Vendor / ecosystem dashboards
The 20 dashboards below all use the same
generic `vendor_dashboard` Askama template,
driven by a single `VENDOR_SPECS` table —
adding a new row registers a new dashboard
without touching the template. Each shows
the **last 25 entries** for its source with
HTMX "Load next 25" pagination and a
per-advisory drill-down at
`/dashboards/<slug>/<advisory_id>`.
Operator pattern: when a customer asks
"what's the latest from $VENDOR?", the answer
is one click in this dropdown.
#### CERT-Bund
**Navigation:** Dashboards → **CERT-Bund** (or
`/dashboards/cert-bund`).
CSAF advisories from the German national CERT
(`csaf_certbund`).
#### Cisco
**Navigation:** Dashboards → **Cisco** (or
`/dashboards/cisco`).
CSAF advisories from
`csaf_cisco` — Cisco Systems product PSIRT.
#### CVE List v5
**Navigation:** Dashboards → **CVE List v5**
(or `/dashboards/cvelistv5`).
The official MITRE CVE 5.0 record store —
the canonical record format for every CVE.
#### FKIE-NVD
**Navigation:** Dashboards → **FKIE NVD**
(or `/dashboards/fkie-nvd`).
Fraunhofer FKIE's CVE re-issue feed — useful
when NVD itself is down or behind on
ingestion.
#### GCVE
**Navigation:** Dashboards → **GCVE**
(or `/dashboards/gcve`).
CIRCL's Global CVE feed (the IDs themselves,
not the enrichment dashboard above which
joins them with our CVE corpus).
#### GitHub
**Navigation:** Dashboards → **GitHub**
(or `/dashboards/github`).
The GitHub Advisory Database (OSV-shaped) —
covers package-ecosystem advisories that
often arrive BEFORE NVD assigns a CVE.
#### GSD (since v0.1.44)
**Navigation:** Dashboards → **GSD**
(or `/dashboards/gsd`).
`gsd` — the Cloud Security Alliance's
Global Security Database, a community-
curated CVE-adjacent advisory feed. Sits
alphabetically between **GitHub** and
**Go** in the "Vulnerability feed"
category of the dropdown.
**Maintenance banner.** This is the first
dashboard to render a yellow Bootstrap
"alert alert-warning" block above the
stats strip:
> *Data source no longer maintained. This
> data source is no longer maintained —
> the upstream
> `cloudsecurityalliance/gsd-database`
> repository was last updated 2024-04-29.
> Do not expect further updates;
> displayed entries are a historical
> snapshot.*
The banner is driven by the new
`VendorSpec.maintenance_note` field; any
future abandoned source can opt in to the
same banner by setting that field on its
`VENDOR_SPECS` row.
#### Go (OSV)
**Navigation:** Dashboards → **Go**
(or `/dashboards/go`).
`osv_golang` — the Go vulnerability database
(`vuln.go.dev`). Curated by the Go security
team for module-level advisories.
#### JVN
**Navigation:** Dashboards → **JVN**
(or `/dashboards/jvn`).
Japan Vulnerability Notes — the Japanese
JPCERT/CC + IPA joint advisory database.
Useful for catching CVEs in Japanese-vendor
products that NVD covers slowly.
#### Microsoft
**Navigation:** Dashboards → **Microsoft**
(or `/dashboards/microsoft`).
`csaf_microsoft` — the Microsoft Security
Response Center (MSRC) CSAF feed. Patch
Tuesday lives here.
#### ndaal
**Navigation:** Dashboards → **ndaal**
(or `/dashboards/ndaal`).
ndaal's own published CSAF advisories
(`ndaal-sa-YYYY-NNN`). Used to broadcast
findings from this codebase's release
pipeline AND advisories about consultancy
findings.
#### openSUSE
**Navigation:** Dashboards → **openSUSE**
(or `/dashboards/opensuse`).
`csaf_opensuse` — the openSUSE security feed
(SUSE-SU-YYYY-NNNN advisories).
#### Oracle
**Navigation:** Dashboards → **Oracle**
(or `/dashboards/oracle`).
`csaf_oracle` — Oracle's quarterly
Critical Patch Update CSAF feed. Database,
WebLogic, Java, the lot.
#### Pentagrid
**Navigation:** Dashboards → **Pentagrid**
(or `/dashboards/pentagrid`).
`csaf_pentagrid` — pentest findings published
by the Swiss firm Pentagrid AG. Mostly
hardware / IoT defects.
#### Python (PySec)
**Navigation:** Dashboards → **Python**
(or `/dashboards/python`).
`pysec` — the OSV-shaped Python advisory
database, covering PyPI packages.
#### Red Hat
**Navigation:** Dashboards → **Red Hat**
(or `/dashboards/redhat`).
`csaf_redhat` — Red Hat's Errata + Bugzilla-
backed CSAF advisories. Your RHSA / RHBA /
RHEA stream.
#### Rust (RustSec)
**Navigation:** Dashboards → **Rust**
(or `/dashboards/rust`).
`osv_rustsec` — the RustSec advisory
database, covering crates.io packages. A
must-watch when shipping a `Cargo.lock` to
production.
#### SUSE
**Navigation:** Dashboards → **SUSE**
(or `/dashboards/suse`).
`csaf_suse` — SUSE's enterprise security feed
(SUSE-SU-YYYY-NNNN advisories — same shape
as openSUSE but supported product matrix).
#### Ubuntu
**Navigation:** Dashboards → **Ubuntu**
(or `/dashboards/ubuntu`).
`osv_ubuntu` — Canonical's Ubuntu Security
Notices (USNs).
#### VMware
**Navigation:** Dashboards → **VMware**
(or `/dashboards/vmware`).
`csaf_vmware` — VMware's VMSA security
advisory feed. Includes vCenter, ESXi,
NSX, Workstation.
#### Vulnrichment (since v0.1.36)
**Navigation:** Dashboards → **Vulnrichment**
(or `/dashboards/vulnrichment`).
CISA's Vulnrichment program — adds CVSS,
CWE, KEV-status, and remediation hints to
CVEs that are otherwise sparsely populated.
### CNA Scorecard
**Navigation:** top navbar → **CNA Scorecard**
(or `/cna-scorecard`).
**Why this page exists:** scores every CVE
Numbering Authority on disclosure cadence,
CWE coverage, CVSS completeness, and KEV-flag
adoption. Refreshed hourly. When a vendor
asks "how good is my CNA hygiene?", this is
the answer.
### Info dropdown
The right-corner **Info** dropdown
(`partials/nav_right.html`) gathers six
pages that don't fit anywhere else. Every
page in the dropdown is reachable from
every other page in the app — by design,
since they're typically operator-only-once
visits.
#### About
**Navigation:** top-right **Info** → **About**
(or `/about`).
The marketing landing page — what
nvulnlookup is, what it covers, the live
[rust-doctor](https://crates.io/crates/rust-doctor)
score, the licence headline. The first stop
for anyone evaluating the project.
#### System info
**Navigation:** top-right **Info** →
**System info** (or `/system-info`).
Live deployment introspection: version,
uptime, total indexed vulnerabilities,
memory + disk usage of redb / SQLite, list of
configured feeders. The page operators
screenshot when filing a bug.
#### Privacy
**Navigation:** top-right **Info** →
**Privacy** (or `/privacy`).
GDPR-aware privacy policy: this self-hosted
deployment processes only the public CVE
corpus and the operator's own annotation
metadata — no third-party analytics, no
tracking pixels, no telemetry.
#### Security
**Navigation:** top-right **Info** →
**Security** (or `/security`).
Hardening posture: TLS 1.3-only listeners,
the
[`security.txt`](https://www.rfc-editor.org/rfc/rfc9116)
contact, our PGP key, our CSAF disclosure
shape, our cargo-vet posture.
#### Licence
**Navigation:** top-right **Info** →
**License** (or `/license`).
Apache-2.0 plus a per-dependency licence
table with copies of every upstream LICENSE
file embedded in the binary. Run-once
compliance check.
#### Imprint (since v0.1.42)
**Navigation:** top-right **Info** →
**Imprint** (or `/imprint`).
German legal-notice landing page (§ 5 TMG /
§ 10 MStV) for the EU-hosted reference
deployment. 14 alias redirects (`/impressum`,
`/datenschutz`, `/sicherheit`, `/lizenz`, …)
land here too.
### Annotations dropdown
#### Notifications
**Navigation:** top navbar → **Annotations** →
**Notifications** tab (or
`/annotations?tab=notifications`).
**Why this page exists:** in-app alerts that
fire when a sighting / KEV flag flip / new
advisory matches an operator-defined
pattern. The hub for "let me know when X
happens" workflows that don't rise to the
level of a full ticket.
### Per-CVE detail — Log4Shell reference
**Navigation:** any link to a CVE — e.g. from
`/recent`, `/sightings`, or a dashboard's
recent table. Direct URL:
`/vulnerability/CVE-2021-44228`.
**Why this page exists:** the canonical
"everything we know about this CVE" landing
page. Captured here on
[CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
(Log4Shell) because it lights up every
enrichment surface the v0.1.42 release
introduced — CAPEC, CISA-KEV, EPSS, Nuclei,
GitHub Advisory, OSV: Maven, plus the
aggregated bundle (one JSON with every
available source, downloadable via the
`/api/v1/vulnerability/{id}/enrichment`
endpoint).
When `/sightings` lists a CVE that hasn't
landed in the canonical vulnerabilities
table yet, this page renders a 200
placeholder showing whatever enrichment
cards are available — the bug-fix in
v0.1.42 that replaced the previous 404.
## End of visual tour
## Home Page
The home page shows aggregate statistics and
recent vulnerabilities.
- **Total Vulnerabilities** count
- **Critical Severity** count
- **Data Sources** count
- **Recent vulnerabilities** table with ID,
title, severity badge, CVSS score, source,
and last-modified date
### Dark Mode
Toggle the theme using the moon/sun icon in
the navigation bar.
## Searching
Use the search bar in the navigation or the
large search input on the home page.
- Search by **CVE ID**: `CVE-2021-44228`
- Search by **keyword**: `log4j`, `buffer
overflow`, `remote code execution`
- Search by **advisory ID**: `GHSA-*`,
`RUSTSEC-*`, `GO-*`
Results update live as you type (HTMX).
### Partial words (since v1.2.66)
A query now matches a **prefix** of an
indexed word, so you no longer have to type a
whole term to get a hit. An exact match still
outranks a prefix match, so searching `log4j`
keeps the `log4j` entries at the top.
Before v1.2.66 a partial word returned nothing
at all. Measured on the reference corpus of
384,585 CVE records and 432 ndaal advisories:
| Query | Before v1.2.66 | v1.2.66 |
| --- | ---: | ---: |
| `log4` | 0 | 50 |
| `log4she` | 0 | 6 |
| `heartble` | 0 | 1 |
### "Search unavailable" (since v1.2.66)
If a search runs past its time budget, the
page now says so: the server answers HTTP
**503 Service Unavailable** with a
`retry-after: 30` header. Wait half a minute
and try the query again.
Before v1.2.66 that same timeout rendered as
an empty result list, which was
indistinguishable from "nothing matched" — an
outage was reported as a legitimate answer. An
empty result page now means one thing only: no
record matched your query.
## Dashboard
The dashboard at `/dashboard` provides visual
analytics across all vulnerability data.
### CVE Publishing Statistics
- **Total CVEs**: aggregate count
- **Daily Rate**: average CVEs per day
- **Mean Gap**: average time between publications
- **Batch Rate**: percentage published within
60 seconds of another
- **Hourly Distribution** (UTC): bar chart
- **Top 10 CNAs**: pie chart
- **Monthly Trend**: line chart
### CVSS Severity Distribution
- Toggle between **CVSS 3.1** and **CVSS 4.0**
- Select timeframe: 1, 2, 3, 4, 5, or 6 months
- Pie chart + bar chart showing CRITICAL / HIGH
/ MEDIUM / LOW / NONE
### Vendor / Ecosystem Charts
- Source tabs: NVD, Rust, OSV, PySec, JVN,
VARIoT, GitHub, GSD, US KEV
- Top N selector (1, 5, 10, 25, 50)
- Chart type: Pie, Bar, or Line
## Vulnerability Detail
Click any vulnerability ID to see:
- **Header**: ID, severity badge, CVSS score
- **Description**: Full advisory text
- **Timeline**: Published and modified dates
- **CVSS Details**: Attack vector, complexity
- **Affected Products**: If available
- **References**: Clickable external links
- **Linked Vulnerabilities**: Related entries
- **Raw JSON**: Collapsible accordion
## Recent Page
Browse the full list of recent vulnerabilities
at `/recent`. Features:
- **Timeframe picker**: 24h, 7 days, 30 days,
90 days, or all time
- **Source filter**: Click source badges to
filter by specific feeds
- **Pagination**: "Load more" button for
infinite scroll
## Debian Security Tracker (since v0.1.31)
Navigate to `/dashboards/debian` for a live
view of the Debian Security Tracker:
- **Stats card**: total packages, CVEs, open /
fixed counts, urgency breakdown
- **Top packages by open CVEs**
- **Per-release breakdown**
(oldstable / stable / testing / unstable /
experimental)
- **Urgency histogram**
- **Last 25 recent entries** with an in-page
**"Load next 25"** button: each click fetches
the next page via HTMX and appends rows to
the same table, up to 500 entries total —
no full navigation.
- Every CVE cell is a link to
`/dashboards/debian/cve/{id}`, which shows
the standard merged-view detail page PLUS a
**"Debian Security Note (raw)"** accordion
card with the upstream tracker payload for
that CVE. When the CVE is tracked by Debian
but not yet in any upstream feed, the page
still renders (with a minimal header and the
raw Debian blob) instead of 404'ing.
- When upstream ships an empty `description`
for a CVE, the dashboard synthesizes one
from the `releases` sub-object
(e.g. `"Open in sid; Fixed in bookworm
(1.2.3-4)"`).
## Vendor Dashboards (since v0.1.34)
Fifteen additional dashboards sit next to the
Debian one under the **Dashboards** dropdown
(alphabetised after "Overview"):
- `/dashboards/cert-bund` — BSI CERT-Bund WID
CSAF advisories
- `/dashboards/cisco` — Cisco PSIRT
- `/dashboards/github` — GitHub Advisory DB
(OSV)
- `/dashboards/go` — Go Vulnerability DB (OSV)
- `/dashboards/microsoft` — Microsoft MSRC
- `/dashboards/ndaal` — ndaal-published CSAF
advisories
- `/dashboards/opensuse` — openSUSE Project
- `/dashboards/oracle` — Oracle CPU
- `/dashboards/pentagrid` — Pentagrid
- `/dashboards/python` — PyPI / PySec
- `/dashboards/redhat` — Red Hat Product
Security
- `/dashboards/rust` — RustSec Advisory DB
(OSV)
- `/dashboards/suse` — SUSE Linux Enterprise
- `/dashboards/ubuntu` — Ubuntu Security
Notices
- `/dashboards/vmware` — VMware / Broadcom
Each page shows the **Last 25 recent entries**
for its source, HTMX "Load next 25" pagination,
and a per-advisory drill-down at
`/dashboards/<slug>/<advisory_id>`. The recent
table lists **Advisory · Severity · CVSS ·
Published · Title** — the **CVSS** column shows
the numeric base score (e.g. `9.8`) extracted
from the advisory's CVSS metrics, and is blank
when the source carries no score. The same
content is also reachable at
`/vulnerability/<vendor>/<advisory_id>` for
operators who prefer a vendor-qualified URL.
Unlike the Debian dashboard, these do not
pre-aggregate upstream JSON — they query the
shared vulnerability store by source
(`get_last(source = Some(…))`) and rely on the
generic `/vulnerability/{id}` merged view for
the drill-down. When a feeder has not yet
populated data for a source, the dashboard
renders cleanly with "no advisories yet".
## CNA Scorecard
Navigate to `/cna-scorecard` for quality scores
of CVE Numbering Authorities (sourced from
[RogoLabs/CNAScoreCard](https://github.com/RogoLabs/CNAScoreCard)).
**Refreshed every hour** (since v0.1.31;
previously every 12 hours).
## KEV Catalogs
Navigate to `/kev` for Known Exploited
Vulnerabilities catalogs:
- **CISA KEV**: US Cybersecurity and
Infrastructure Security Agency
- **CIRCL KEV**: CIRCL Luxembourg
- **EUVD KEV**: EU Vulnerability Database
## Theme
Click the moon/sun icon in the top-right
navbar to toggle between **light** (default)
and **dark** themes. Your preference is
saved automatically.
## About Page
The about page at `/about` shows:
- Version and rust-doctor quality scores
- Security features (TLS, fuzzing, auditing)
- Comparison table: CIRCL vs ndaal
- Architecture overview
## License
Apache License, Version 2.0. See `/license`.
## System Information
The system info page at `/system-info` shows:
- OS, kernel, hostname
- CPU, memory, swap, disk usage
- Uptime
## RSS and Atom Feeds
Subscribe to vulnerability updates:
- RSS: `https://localhost:8080/feed/rss`
- Atom: `https://localhost:8080/feed/atom`
## Severity Badges
| Badge | CVSS Range | Color |
| --- | --- | --- |
| CRITICAL | 9.0 - 10.0 | Red |
| HIGH | 7.0 - 8.9 | Orange |
| MEDIUM | 4.0 - 6.9 | Yellow |
| LOW | 0.1 - 3.9 | Green |