gcve.eu

Luxembourg, 2026/01/07 - The GCVE initiative is proud to announce the public launch of db.gcve.eu , a new open and freely accessible vulnerability advisory database. The platform aggregates and correlates vulnerability information from more than 25 public sources, including GCVE GNA (Numbering Authority) sources and other established vulnerability databases.

🔗 For more details - https://gcve.eu/2026/01/07/gcve-db-announce/
🔗 https://db.gcve.eu/

#cve #gcve #cybersecurity #vulnerabilitymanagement #vulnerability

GCVE released cpe.gcve.eu - a collaborative CPE editing platform for transparent vulnerability data.

The service is still in beta and feedback is more than welcome.

🔗 https://cpe.gcve.eu/

#cpe #cve #vulnerabilitymanagement #vulnerability #gcve

We are today at @passthesaltcon@infosec.exchange and @adulau@infosec.exchange will do a presentation about the GCVE initiative and explain what are the next crazy projects we are working on.

🔗 https://gcve.eu/

#gcve #cpe #cve #cybersecurity #opensource #opendata

During the last three months, from 25 February to 25 May 2026, GCVE has continued moving beyond an identifier-allocation concept into a practical ecosystem for publishing, correlating, enriching and consuming vulnerability information.

What have we accomplished over the past three months? Quite a lot. To learn more about our latest public developments and ongoing work, read our latest status update on the blog:

🔗 https://gcve.eu/2026/05/25/gcve-recent-activities-building-a-decentralised-and-operational-vulnerability-ecosystem/

#cve #gcve #vulnerabilitymanagement #cybersecurity

Vulnerability-Lookup 5.0 Released: Making Coordinated Vulnerability Disclosure Easier for GCVE GNAs.

Vulnerability-Lookup 5.0 introduces a new CNA-interoperable API for managing vulnerabilities maintained by a local source.

#cve #gcve #vulnerabilitymanagement #cybersecurity #gna #vulnerability

🔗 https://gcve.eu/2026/05/29/vulnerability-lookup-5.0-released-making-coordinated-vulnerability-disclosure-easier-for-gcve-gnas/

We just published a new GCVE repository: gcve-enriched-dumps.

This repository demonstrates a practical and reproducible enrichment pipeline for vulnerability records. The current workflow uses VLAI, a RoBERTa-based model from Vulnerability-Lookup, to estimate vulnerability severity directly from vulnerability descriptions.

For more details: https://gcve.eu/2026/05/21/gcve-enriched-dumps/

@circl@social.circl.lu

#cve #gcve #vulnerabilitymanagement #cybersecurity #opensource #opendata #ai

We are happy to announce a new extension mechanism in the GCVE vulnerability format, starting with a very practical and timely one: AI-assisted vulnerability information annotations.

The first extension, GCVE BCP-05-X-01, defines how GCVE records can describe when AI or automated processing was used to create, enrich, summarize, classify, or analyze vulnerability information.

#ai #ia #gcve #vulnerabilitymanagement #vulnerability #opensource #openstandard

🔗 https://gcve.eu/bcp/extension/gcve-bcp-05-x-01/

The past six weeks have been an important milestone for the GCVE.eu initiative. What started as an experiment in decentralized vulnerability identification and coordination continues to evolve into a mature ecosystem supported by standards, implementations, and a rapidly growing community.

BCP-07 published and already implemented. BCP-06 published. Many ongoing activities for GCVE.

🔗 https://gcve.eu/2026/02/15/what-s-new-2026-02-15/

#gcve #cve #vulnerabilitymanagement #vulnerability #cybersecurity

@circl@social.circl.lu

GCVE-BCP-10: Improved Common Platform Enumeration for GCVE

This document specifies an improved platform enumeration model for GCVE aligned with the current implementation of cpe-editor.

#cpe #cve #gcve #infosec #vulnerabilitymanagement

🔗 https://gcve.eu/bcp/gcve-bcp-10/

The GCVE project team will be at the Hackathon in Luxembourg on April 14–15, 2026, to present the project and collaborate on its future.

We’d be delighted to welcome anyone interested in joining us and contributing to the future of GCVE.

https://hackathon.lu/projects/#gcve

#gcve #cve #hackathon #cybersecurity

@circl@social.circl.lu

db.gcve.eu updated with Vulnerability-Lookup 4.0: Enabling Federated Vulnerability Intelligence

The GCVE project is pleased to announce a major update of the platform. The service is now running the latest version of Vulnerability-Lookup (4.0), introducing federated synchronisation capabilities that significantly expand how vulnerability intelligence can be shared, enriched, and consumed across organisations.

🔗 https://gcve.eu/2026/02/17/db-gcve-eu-updates-2026/

#gcve #cve #cvd #opensource

GCVE is not only designed for distributed vulnerability publication and correlation across multiple sources. It already provides automatic vulnerability classification capabilities through the broader Vulnerability-Lookup ecosystem. In particular, GCVE can rely on VL-AI to automatically estimate vulnerability severity from historical data, giving defenders an immediate first-pass assessment even when no manually curated score is yet available.

#gcve #cve #nist

🔗 https://gcve.eu/2026/04/17/automatic-vulnerability-intelligence/

Introducing CPE.GCVE.EU: A collaborative catalog for vendors, products, CPEs and PURLs

#cve #cpe #gcve #opendata #opensource
#cybersecurity #vulnerabilitymanagement

https://gcve.eu/2026/06/02/introducing-cpe.gcve.eu-a-collaborative-catalog-for-vendors-products-cpes-and-purls/

@jbm@infosec.exchange

CPE exists and we have to deal with it.

What we try to do is the following:

• Providing a way for any contributors to link mistyped vendor/products, product renamed along with metadata.
• The CPE there includes all the different sources known for CPE including NIST, CVE Program cvelist_v5 or CPE2PURL. Each of the dataset was covering only a part of the full CPE coverage.

It mainly helps to find vulnerability scattered across vendor or product names.

https://gcve.eu/2026/06/02/introducing-cpe.gcve.eu-a-collaborative-catalog-for-vendors-products-cpes-and-purls/

Many updates to the GCVE BCP and two new BCPs are in preparation:

🔗 Current BCPs https://gcve.eu/bcp/
🔗 Discussions https://discourse.ossbase.org/c/gcve/14

#gcve #cve #vulnerabilitymanagement #vulnerability #cybersecurity

@circl@social.circl.lu

We now have a page dedicated to all the software developed in the scope of GCVE or implementing the GCVE BCP standards.

https://gcve.eu/software/

#gcve #cve #openstandard #opensource #cybersecurity

GCVE-BCP-09: Scope of a GCVE Record

This document clarifies what is actually recorded in GCVE. A GCVE record is not limited to the traditional concept of a vulnerability description. In the GCVE model, records are assigned independently by a GCVE Numbering Authority (GNA) and may represent a broader set of vulnerability-related information.

#cve #gcve #vulnerabilitymanagement #vulnerability #opensource #standard

🔗 https://gcve.eu/bcp/gcve-bcp-09/

Publishing Vulnerability Information with GCVE

With GCVE, publishing vulnerability information can be done in three straightforward steps.

#gcve #vulnerabilitymanagement #vulnerability #cybersecurity

🔗 https://gcve.eu/publishing-vulnerability-information/

GCVE-BCP-01 through GCVE-BCP-05 have now all reached the published state. These published documents remain open to review and updates. The BCPs have been implemented in multiple implementations, including vulnerability-lookup.

🔗 https://gcve.eu/bcp/

#cve #gcve #vulnerabilitymanagement

@jbm@infosec.exchange Yes, it's to facilitate the use of the data from GCVE and other vulnerability sources. So it's a dedicated vulnerability-lookup instance running independently. @circl@social.circl.lu instance will remain and running on its own.

We also recommend others to operate their own instance and especially GNA to facilitate the distributed publication.

We added your question in the FAQ https://gcve.eu/faq/#q16-what-is

Everyone like ENISA is welcome to use and contribute to vulnerability-lookup for their use-cases.

@tsdgeos@fosstodon.org You can ask a GNA such as @circl@social.circl.lu or even become a GNA yourself.

https://gcve.eu/about/#eligibility-and-process-to-obtain-a-gna-id

@westonsteimel@hachyderm.io

The dumps will be available on db.gcve.eu but currently it's on the CIRCL dumps.

@circl@social.circl.lu