<!-- Copyright (c) 2026 Pierre Gronau, ndaal in Cologne -->
# User Guide
## Accessing the Web UI
Open your browser and navigate to:
```text
https://localhost:8080/
```
On first visit you will see a self-signed
certificate warning. Click **Advanced** then
**Proceed to localhost** to continue.
### Which port?
nvulnlookup serves the web UI and the API on
**8080** (TLS 1.3 over TCP, HTTP/1.1 +
HTTP/2). Port **8081** is the QUIC / HTTP/3
listener for the same content.
Those two numbers belong to nvulnlookup only.
On a host that also runs other ndaal
services, `8180` / `8181` is csaf-crud and
`8680` / `8681` is sbom-auditor — so
`https://localhost:8180/` is a different
application, not this one.
## Dashboards dropdown — fluid responsive layout (v0.1.45)
The Dashboards navbar menu adapts its column
count to the viewport width. No setting — open
the dropdown and the browser picks how many
columns to use based on the available space:
| Viewport (typical device) | Columns |
| --- | :---: |
| 360 px (phone portrait) | 1 |
| 768 px (tablet) | 3 |
| 1024 px (laptop) | 5 |
| 1366 px (laptop+) | 8 |
| 1600 px (display) | 9 |
| 1920 px (desktop) | 11 |
| ≥ 3840 px (4K) | 12 (capped) |
If an item you expect to see (e.g. a vendor
dashboard like Cisco, Microsoft, IBM, Red Hat,
or an OSV ecosystem like Rust, Python, Go,
npm) appears below the visible area:
1. The full list is **always present** in the
HTML — verify with
`curl -sk https://localhost:8080/ \
| grep -F '/dashboards/<slug>'`.
2. Maximise the browser window, or zoom out
(Ctrl/Cmd + minus) one notch.
3. As a UX safety belt, scroll the page — the
dropdown extends past the viewport rather
than being clipped (deliberate: clipping
was the pre-v0.1.43 bug that hid the OSV +
VulnerabilityFeed categories).
Pre-v0.1.45 the dropdown used fixed
breakpoints (1 col / 2 cols / 9 cols at
576 px and 992 px) which produced a
single-column tall list on 1366 px laptops
and an off-viewport overflow on smaller
screens. See `CHANGELOG.md` v0.1.45 entry
for the CSS rewrite details.
## Visual Tour — every page in the v0.1.42 navbar
This section walks every page reachable from the
top navigation bar and explains:
- **Navigation** — the click path from the home
page to that screen.
- **Why this page exists** — the operator
problem it solves and the data source(s)
driving it.
- **The screenshot** — captured at 1920 × 1080
in light theme against a freshly seeded
`vl-web` instance. All images live under
`documentation/graphics/light/`; a parallel
dark-theme set lives under
`documentation/graphics/dark/`. Filenames
carry no timestamp by design — Markdown links
point to stable names so a refresh updates
the image in place.
Re-capture the entire set against your own
deployment with:
```bash
bash scripts/create_screenshots_from_local_running_app.sh
```
### Top-level navigation
#### Home
**Navigation:** Click the **Vulnerability-Lookup**
brand on the top-left of every page (or visit
`/` directly).
**Why this page exists:** the canonical landing
page. Surfaces the three numbers an operator
checks first — total indexed vulnerabilities,
total Critical-severity rows, and active data
sources — plus a search bar pre-tuned for CVE
ID / keyword / Log4Shell / buffer-overflow
queries, plus the most-recent 25
vulnerabilities so a fresh visitor can see
that the indexer is alive.
#### Statistics
**Navigation:** top navbar → **Statistics**
(or `/stats`).
**Why this page exists:** raw aggregate
numbers — total CVE rows, breakdowns per
severity bucket and per source. Use this when
"how big is the index right now?" is the
question; the [Dashboard](#dashboard) renders
the same data as charts.
#### Dashboard
**Navigation:** top navbar → **Dashboards** →
**Overview** (or `/dashboard`).
**Why this page exists:** charts, not numbers —
CVE publishing rate over time, CVSS severity
distribution (3.1 / 4.0 toggle), top CNAs,
feeder activity summary. This is the page
that goes on a dashboard wall during a
SOC handover.
#### Recent
**Navigation:** top navbar → **Recent**
(or `/recent`).
**Why this page exists:** paginated list of
the most-recently-modified vulnerabilities
across every source. Filterable by source
(comma-separated) and by an `?days=N`
look-back window. This is the page on which
a vulnerability analyst starts every shift.
#### KEV
**Navigation:** top navbar → **KEV**
(or `/kev`).
**Why this page exists:** lists every entry
on the CISA Known Exploited Vulnerabilities
catalog — the gold-standard "patch this NOW"
feed. Each row links to the full advisory
plus our annotation hub for sightings and
operator notes.
**Other catalogs:** the page has one tab per catalog — CISA KEV, CIRCL KEV, EUVD
KEV, VulnCheck KEV and ndaal KEV. The VulnCheck catalog needs an API token that
an administrator stores on the server. While it has no entries, its tab says why
instead of leaving the table blank: for example that no token is stored, that
VulnCheck refused it, or that the feeder has not finished its first run yet
(it starts 35 minutes after the server). That message is meant for your
administrator; there is nothing to fix on your side.
### Specialised dashboards
These dashboards have custom URL shapes or
data models that don't fit the generic
`VENDOR_SPECS` template. Each one solves a
specific operator question.
#### CAPEC enrichments
**Navigation:** top navbar → **Dashboards** →
**CAPEC Enrichments** (or
`/dashboards/capec-enrichment`).
**Why this dashboard exists:** MITRE CAPEC
(Common Attack Pattern Enumeration and
Classification) maps each CWE to the
adversary techniques used to exploit it.
This dashboard joins our CWE enrichment with
the CAPEC dictionary so a defender can answer
"what attack pattern do I look for in WAF /
EDR logs given the CWE family of this CVE?"
#### GCVE enrichments
**Navigation:** top navbar → **Dashboards** →
**GCVE Enrichments** (or
`/dashboards/gcve-enrichment`).
**Why this dashboard exists:** GCVE
(Global CVE allocation) is CIRCL's GNA-aware
ID schema — a stable cross-CNA identifier
that survives MITRE re-issues and CNA
mergers. This dashboard tracks how many of
our CVEs already have a GCVE counterpart and
highlights the gaps.
#### EPSS — Exploit Prediction Scoring (since v0.1.41)
**Navigation:** top navbar → **Dashboards** →
**EPSS** (or `/dashboards/epss`).
**Why this dashboard exists:** EPSS (FIRST.org
Exploit Prediction Scoring System) gives each
CVE a 0.0–1.0 probability that it will be
exploited within 30 days. This dashboard
cross-tabs EPSS by year and by CVSS-bucket so
an operator can answer "of all the CVEs we're
NOT already patching, which carry the highest
exploitation odds?" The 10-bucket histogram
of raw EPSS probability shows where the
ecosystem's risk mass actually sits.
#### Nuclei templates (since v0.1.41)
**Navigation:** top navbar → **Dashboards** →
**Nuclei Templates** (or
`/dashboards/nuclei_templates`).
**Why this dashboard exists:** ProjectDiscovery's
[nuclei-templates](https://github.com/projectdiscovery/nuclei-templates)
repo carries thousands of fingerprintable
checks — CVE PoCs, default-credential probes,
exposure detectors. This dashboard shows
which of OUR indexed CVEs already have a
Nuclei template (so the analyst can
re-validate the finding offline) and lets the
operator download the raw YAML body in a
single JSON envelope.
The page-source rendering safety of this
dashboard is pinned by an integration test
(`crates/vl-web/tests/test_inline_script_escape.rs`):
nuclei templates frequently embed
`</script>` strings as XSS-detector
matchers, and unescaped emission of the JSON
into an inline `<script>` block would break
the browser's HTML parser.
#### KEV Ransomware (since v0.1.42)
**Navigation:** top navbar → **Dashboards** →
**KEV Ransomware** (or
`/dashboards/kev-ransomware`).
**Why this dashboard exists:** CISA periodically
flips a CVE's `knownRansomwareCampaignUse`
flag in the KEV catalog from `Unknown` to
`Known` — without a public announcement.
This silent update tells defenders the CVE is
now actively exploited by ransomware crews,
but only operators who diff the KEV daily
catch it.
[Greynoise's blog post](https://www.greynoise.io/blog/unmasking-cisas-hidden-kev-ransomware-updates)
documents how they monitor the daily diff.
Their feed plus a historical CSV bootstrap
drive this dashboard.
Sources:
[`kev-ransom-feed.rss`](https://kev.labs.greynoise.io/kev-ransom-feed.rss)
·
[`ransomware-status-changes-2025.csv`](https://info.greynoise.io/hubfs/artifacts/ransomware-status-changes-2025.csv)
#### CVE vs GitHub (since v0.1.42)
**Navigation:** top navbar → **Dashboards** →
**CVE vs GitHub** (or
`/dashboards/cve-vs-github`).
**Why this dashboard exists:** the GitHub
Advisory Database (OSV-shaped) and the
canonical CVE source (NVD / cvelistv5 /
fkie_nvd) frequently disagree on CVSS v3 base
scores. When the disagreement crosses 0.1,
this dashboard surfaces the deviation —
total count, per-severity bucket, per year.
Useful for triage when the two scoring
authorities disagree on whether something is
"High" or "Critical".
### Vendor / ecosystem dashboards
The 20 dashboards below all use the same
generic `vendor_dashboard` Askama template,
driven by a single `VENDOR_SPECS` table —
adding a new row registers a new dashboard
without touching the template. Each shows
the **last 25 entries** for its source with
HTMX "Load next 25" pagination and a
per-advisory drill-down at
`/dashboards/<slug>/<advisory_id>`.
Operator pattern: when a customer asks
"what's the latest from $VENDOR?", the answer
is one click in this dropdown.
#### CERT-Bund
**Navigation:** Dashboards → **CERT-Bund** (or
`/dashboards/cert-bund`).
CSAF advisories from the German national CERT
(`csaf_certbund`).
#### Cisco
**Navigation:** Dashboards → **Cisco** (or
`/dashboards/cisco`).
CSAF advisories from
`csaf_cisco` — Cisco Systems product PSIRT.
#### CVE List v5
**Navigation:** Dashboards → **CVE List v5**
(or `/dashboards/cvelistv5`).
The official MITRE CVE 5.0 record store —
the canonical record format for every CVE.
#### FKIE-NVD
**Navigation:** Dashboards → **FKIE NVD**
(or `/dashboards/fkie-nvd`).
Fraunhofer FKIE's CVE re-issue feed — useful
when NVD itself is down or behind on
ingestion.
#### GCVE
**Navigation:** Dashboards → **GCVE**
(or `/dashboards/gcve`).
CIRCL's Global CVE feed (the IDs themselves,
not the enrichment dashboard above which
joins them with our CVE corpus).
#### GitHub
**Navigation:** Dashboards → **GitHub**
(or `/dashboards/github`).
The GitHub Advisory Database (OSV-shaped) —
covers package-ecosystem advisories that
often arrive BEFORE NVD assigns a CVE.
#### GSD (since v0.1.44)
**Navigation:** Dashboards → **GSD**
(or `/dashboards/gsd`).
`gsd` — the Cloud Security Alliance's
Global Security Database, a community-
curated CVE-adjacent advisory feed. Sits
alphabetically between **GitHub** and
**Go** in the "Vulnerability feed"
category of the dropdown.
**Maintenance banner.** This is the first
dashboard to render a yellow Bootstrap
"alert alert-warning" block above the
stats strip:
> *Data source no longer maintained. This
> data source is no longer maintained —
> the upstream
> `cloudsecurityalliance/gsd-database`
> repository was last updated 2024-04-29.
> Do not expect further updates;
> displayed entries are a historical
> snapshot.*
The banner is driven by the new
`VendorSpec.maintenance_note` field; any
future abandoned source can opt in to the
same banner by setting that field on its
`VENDOR_SPECS` row.
#### Go (OSV)
**Navigation:** Dashboards → **Go**
(or `/dashboards/go`).
`osv_golang` — the Go vulnerability database
(`vuln.go.dev`). Curated by the Go security
team for module-level advisories.
#### JVN
**Navigation:** Dashboards → **JVN**
(or `/dashboards/jvn`).
Japan Vulnerability Notes — the Japanese
JPCERT/CC + IPA joint advisory database.
Useful for catching CVEs in Japanese-vendor
products that NVD covers slowly.
#### Microsoft
**Navigation:** Dashboards → **Microsoft**
(or `/dashboards/microsoft`).
`csaf_microsoft` — the Microsoft Security
Response Center (MSRC) CSAF feed. Patch
Tuesday lives here.
#### ndaal
**Navigation:** Dashboards → **ndaal**
(or `/dashboards/ndaal`).
ndaal's own published CSAF advisories
(`ndaal-sa-YYYY-NNN`). Used to broadcast
findings from this codebase's release
pipeline AND advisories about consultancy
findings.
#### openSUSE
**Navigation:** Dashboards → **openSUSE**
(or `/dashboards/opensuse`).
`csaf_opensuse` — the openSUSE security feed
(SUSE-SU-YYYY-NNNN advisories).
#### Oracle
**Navigation:** Dashboards → **Oracle**
(or `/dashboards/oracle`).
`csaf_oracle` — Oracle's quarterly
Critical Patch Update CSAF feed. Database,
WebLogic, Java, the lot.
#### Pentagrid
**Navigation:** Dashboards → **Pentagrid**
(or `/dashboards/pentagrid`).
`csaf_pentagrid` — pentest findings published
by the Swiss firm Pentagrid AG. Mostly
hardware / IoT defects.
#### Python (PySec)
**Navigation:** Dashboards → **Python**
(or `/dashboards/python`).
`pysec` — the OSV-shaped Python advisory
database, covering PyPI packages.
#### Red Hat
**Navigation:** Dashboards → **Red Hat**
(or `/dashboards/redhat`).
`csaf_redhat` — Red Hat's Errata + Bugzilla-
backed CSAF advisories. Your RHSA / RHBA /
RHEA stream.
#### Rust (RustSec)
**Navigation:** Dashboards → **Rust**
(or `/dashboards/rust`).
`osv_rustsec` — the RustSec advisory
database, covering crates.io packages. A
must-watch when shipping a `Cargo.lock` to
production.
#### SUSE
**Navigation:** Dashboards → **SUSE**
(or `/dashboards/suse`).
`csaf_suse` — SUSE's enterprise security feed
(SUSE-SU-YYYY-NNNN advisories — same shape
as openSUSE but supported product matrix).
#### Ubuntu
**Navigation:** Dashboards → **Ubuntu**
(or `/dashboards/ubuntu`).
`osv_ubuntu` — Canonical's Ubuntu Security
Notices (USNs).
#### VMware
**Navigation:** Dashboards → **VMware**
(or `/dashboards/vmware`).
`csaf_vmware` — VMware's VMSA security
advisory feed. Includes vCenter, ESXi,
NSX, Workstation.
#### Vulnrichment (since v0.1.36)
**Navigation:** Dashboards → **Vulnrichment**
(or `/dashboards/vulnrichment`).
CISA's Vulnrichment program — adds CVSS,
CWE, KEV-status, and remediation hints to
CVEs that are otherwise sparsely populated.
### CNA Scorecard
**Navigation:** top navbar → **CNA Scorecard**
(or `/cna-scorecard`).
**Why this page exists:** scores every CVE
Numbering Authority on disclosure cadence,
CWE coverage, CVSS completeness, and KEV-flag
adoption. Refreshed hourly. When a vendor
asks "how good is my CNA hygiene?", this is
the answer.
### Info dropdown
The right-corner **Info** dropdown
(`partials/nav_right.html`) gathers six
pages that don't fit anywhere else. Every
page in the dropdown is reachable from
every other page in the app — by design,
since they're typically operator-only-once
visits.
#### About
**Navigation:** top-right **Info** → **About**
(or `/about`).
The marketing landing page — what
nvulnlookup is, what it covers, the live
[rust-doctor](https://crates.io/crates/rust-doctor)
score, the licence headline. The first stop
for anyone evaluating the project.
#### System info
**Navigation:** top-right **Info** →
**System info** (or `/system-info`).
Live deployment introspection: version,
uptime, total indexed vulnerabilities,
memory + disk usage of redb / SQLite, list of
configured feeders. The page operators
screenshot when filing a bug.
#### Privacy
**Navigation:** top-right **Info** →
**Privacy** (or `/privacy`).
GDPR-aware privacy policy: this self-hosted
deployment processes only the public CVE
corpus and the operator's own annotation
metadata — no third-party analytics, no
tracking pixels, no telemetry.
#### Security
**Navigation:** top-right **Info** →
**Security** (or `/security`).
Hardening posture: TLS 1.3-only listeners,
the
[`security.txt`](https://www.rfc-editor.org/rfc/rfc9116)
contact, our PGP key, our CSAF disclosure
shape, our cargo-vet posture.
#### Licence
**Navigation:** top-right **Info** →
**License** (or `/license`).
Apache-2.0 plus a per-dependency licence
table with copies of every upstream LICENSE
file embedded in the binary. Run-once
compliance check.
#### Imprint (since v0.1.42)
**Navigation:** top-right **Info** →
**Imprint** (or `/imprint`).
German legal-notice landing page (§ 5 TMG /
§ 10 MStV) for the EU-hosted reference
deployment. 14 alias redirects (`/impressum`,
`/datenschutz`, `/sicherheit`, `/lizenz`, …)
land here too.
### Annotations dropdown
#### Notifications
**Navigation:** top navbar → **Annotations** →
**Notifications** tab (or
`/annotations?tab=notifications`).
**Why this page exists:** in-app alerts that
fire when a sighting / KEV flag flip / new
advisory matches an operator-defined
pattern. The hub for "let me know when X
happens" workflows that don't rise to the
level of a full ticket.
### Per-CVE detail — Log4Shell reference
**Navigation:** any link to a CVE — e.g. from
`/recent`, `/sightings`, or a dashboard's
recent table. Direct URL:
`/vulnerability/CVE-2021-44228`.
**Why this page exists:** the canonical
"everything we know about this CVE" landing
page. Captured here on
[CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
(Log4Shell) because it lights up every
enrichment surface the v0.1.42 release
introduced — CAPEC, CISA-KEV, EPSS, Nuclei,
GitHub Advisory, OSV: Maven, plus the
aggregated bundle (one JSON with every
available source, downloadable via the
`/api/v1/vulnerability/{id}/enrichment`
endpoint).
When `/sightings` lists a CVE that hasn't
landed in the canonical vulnerabilities
table yet, this page renders a 200
placeholder showing whatever enrichment
cards are available — the bug-fix in
v0.1.42 that replaced the previous 404.
## End of visual tour
## Home Page
The home page shows aggregate statistics and
recent vulnerabilities.
- **Total Vulnerabilities** count
- **Critical Severity** count
- **Data Sources** count
- **Recent vulnerabilities** table with ID,
title, severity badge, CVSS score, source,
and last-modified date
### Dark Mode
Toggle the theme using the moon/sun icon in
the navigation bar.
## Searching
Use the search bar in the navigation or the
large search input on the home page.
- Search by **CVE ID**: `CVE-2021-44228`
- Search by **keyword**: `log4j`, `buffer
overflow`, `remote code execution`
- Search by **advisory ID**: `GHSA-*`,
`RUSTSEC-*`, `GO-*`
Results update live as you type (HTMX).
### Partial words (since v1.2.66)
A query now matches a **prefix** of an
indexed word, so you no longer have to type a
whole term to get a hit. An exact match still
outranks a prefix match, so searching `log4j`
keeps the `log4j` entries at the top.
Before v1.2.66 a partial word returned nothing
at all. Measured on the reference corpus of
384,585 CVE records and 432 ndaal advisories:
| Query | Before v1.2.66 | v1.2.66 |
| --- | ---: | ---: |
| `log4` | 0 | 50 |
| `log4she` | 0 | 6 |
| `heartble` | 0 | 1 |
### "Search unavailable" (since v1.2.66)
If a search runs past its time budget, the
page now says so: the server answers HTTP
**503 Service Unavailable** with a
`retry-after: 30` header. Wait half a minute
and try the query again.
Before v1.2.66 that same timeout rendered as
an empty result list, which was
indistinguishable from "nothing matched" — an
outage was reported as a legitimate answer. An
empty result page now means one thing only: no
record matched your query.
## Dashboard
The dashboard at `/dashboard` provides visual
analytics across all vulnerability data.
### CVE Publishing Statistics
- **Total CVEs**: aggregate count
- **Daily Rate**: average CVEs per day
- **Mean Gap**: average time between publications
- **Batch Rate**: percentage published within
60 seconds of another
- **Hourly Distribution** (UTC): bar chart
- **Top 10 CNAs**: pie chart
- **Monthly Trend**: line chart
### CVSS Severity Distribution
- Toggle between **CVSS 3.1** and **CVSS 4.0**
- Select timeframe: 1, 2, 3, 4, 5, or 6 months
- Pie chart + bar chart showing CRITICAL / HIGH
/ MEDIUM / LOW / NONE
### Vendor / Ecosystem Charts
- Source tabs: NVD, Rust, OSV, PySec, JVN,
VARIoT, GitHub, GSD, US KEV
- Top N selector (1, 5, 10, 25, 50)
- Chart type: Pie, Bar, or Line
## Vulnerability Detail
Click any vulnerability ID to see:
- **Header**: ID, severity badge, CVSS score
- **Description**: Full advisory text
- **Timeline**: Published and modified dates
- **CVSS Details**: Attack vector, complexity
- **Affected Products**: If available
- **References**: Clickable external links
- **Linked Vulnerabilities**: Related entries
- **Raw JSON**: Collapsible accordion
## Recent Page
Browse the full list of recent vulnerabilities
at `/recent`. Features:
- **Timeframe picker**: 24h, 7 days, 30 days,
90 days, or all time
- **Source filter**: Click source badges to
filter by specific feeds
- **Pagination**: "Load more" button for
infinite scroll
## Debian Security Tracker (since v0.1.31)
Navigate to `/dashboards/debian` for a live
view of the Debian Security Tracker:
- **Stats card**: total packages, CVEs, open /
fixed counts, urgency breakdown
- **Top packages by open CVEs**
- **Per-release breakdown**
(oldstable / stable / testing / unstable /
experimental)
- **Urgency histogram**
- **Last 25 recent entries** with an in-page
**"Load next 25"** button: each click fetches
the next page via HTMX and appends rows to
the same table, up to 500 entries total —
no full navigation.
- Every CVE cell is a link to
`/dashboards/debian/cve/{id}`, which shows
the standard merged-view detail page PLUS a
**"Debian Security Note (raw)"** accordion
card with the upstream tracker payload for
that CVE. When the CVE is tracked by Debian
but not yet in any upstream feed, the page
still renders (with a minimal header and the
raw Debian blob) instead of 404'ing.
- When upstream ships an empty `description`
for a CVE, the dashboard synthesizes one
from the `releases` sub-object
(e.g. `"Open in sid; Fixed in bookworm
(1.2.3-4)"`).
## Vendor Dashboards (since v0.1.34)
Fifteen additional dashboards sit next to the
Debian one under the **Dashboards** dropdown
(alphabetised after "Overview"):
- `/dashboards/cert-bund` — BSI CERT-Bund WID
CSAF advisories
- `/dashboards/cisco` — Cisco PSIRT
- `/dashboards/github` — GitHub Advisory DB
(OSV)
- `/dashboards/go` — Go Vulnerability DB (OSV)
- `/dashboards/microsoft` — Microsoft MSRC
- `/dashboards/ndaal` — ndaal-published CSAF
advisories
- `/dashboards/opensuse` — openSUSE Project
- `/dashboards/oracle` — Oracle CPU
- `/dashboards/pentagrid` — Pentagrid
- `/dashboards/python` — PyPI / PySec
- `/dashboards/redhat` — Red Hat Product
Security
- `/dashboards/rust` — RustSec Advisory DB
(OSV)
- `/dashboards/suse` — SUSE Linux Enterprise
- `/dashboards/ubuntu` — Ubuntu Security
Notices
- `/dashboards/vmware` — VMware / Broadcom
Each page shows the **Last 25 recent entries**
for its source, HTMX "Load next 25" pagination,
and a per-advisory drill-down at
`/dashboards/<slug>/<advisory_id>`. The recent
table lists **Advisory · Severity · CVSS ·
Published · Title** — the **CVSS** column shows
the numeric base score (e.g. `9.8`) extracted
from the advisory's CVSS metrics, and is blank
when the source carries no score. The same
content is also reachable at
`/vulnerability/<vendor>/<advisory_id>` for
operators who prefer a vendor-qualified URL.
Unlike the Debian dashboard, these do not
pre-aggregate upstream JSON — they query the
shared vulnerability store by source
(`get_last(source = Some(…))`) and rely on the
generic `/vulnerability/{id}` merged view for
the drill-down. When a feeder has not yet
populated data for a source, the dashboard
renders cleanly with "no advisories yet".
## CNA Scorecard
Navigate to `/cna-scorecard` for quality scores
of CVE Numbering Authorities (sourced from
[RogoLabs/CNAScoreCard](https://github.com/RogoLabs/CNAScoreCard)).
**Refreshed every hour** (since v0.1.31;
previously every 12 hours).
## KEV Catalogs
Navigate to `/kev` for Known Exploited
Vulnerabilities catalogs:
- **CISA KEV**: US Cybersecurity and
Infrastructure Security Agency
- **CIRCL KEV**: CIRCL Luxembourg
- **EUVD KEV**: EU Vulnerability Database
## Theme
Click the moon/sun icon in the top-right
navbar to toggle between **light** (default)
and **dark** themes. Your preference is
saved automatically.
## About Page
The about page at `/about` shows:
- Version and rust-doctor quality scores
- Security features (TLS, fuzzing, auditing)
- Comparison table: CIRCL vs ndaal
- Architecture overview
## License
Apache License, Version 2.0. See `/license`.
## System Information
The system info page at `/system-info` shows:
- OS, kernel, hostname
- CPU, memory, swap, disk usage
- Uptime
## RSS and Atom Feeds
Subscribe to vulnerability updates:
- RSS: `https://localhost:8080/feed/rss`
- Atom: `https://localhost:8080/feed/atom`
## Severity Badges
| Badge | CVSS Range | Color |
| --- | --- | --- |
| CRITICAL | 9.0 - 10.0 | Red |
| HIGH | 7.0 - 8.9 | Orange |
| MEDIUM | 4.0 - 6.9 | Yellow |
| LOW | 0.1 - 3.9 | Green |