CVE snapshot 2026-10-18

The complete published tree of cve-data.carino.systems as it stood on 2026-10-18, kept so that
every number computed from that day — backlog, status mix, enrichment lag — can be computed again by anyone.

snapshot	2026-10-18T08:02:44Z
records	390,807
manifestSha256	6cab2b1830e9ecbbab457b83407957b923ed51a4b5de77deb47a31a96ac21482
cve-snapshot-2026-10-18.tar	66,529,280 bytes, sha256 564d2cb48b69e6cef975be35fa4b953938cc00137b189d83c59f284b23ec246a

manifestSha256 is the hash every tick and every observatory figure cites: the SHA-256 of the
manifest without its stats and ticks keys, re-serialised, plus a newline.

Recomputing it

With curl, not from a browser: release assets redirect without an access-control-allow-origin
header, so no web page can fetch them.

curl -fLO https://github.com/MiguelCarino/CVE-data/releases/download/snapshot-2026-10-18/cve-snapshot-2026-10-18.tar
curl -fLO https://github.com/MiguelCarino/CVE-data/releases/download/snapshot-2026-10-18/SHA256SUMS
sha256sum -c SHA256SUMS
mkdir snapshot && tar -xf cve-snapshot-2026-10-18.tar -C snapshot && cd snapshot
# the manifest hash every figure from this day cites
node -e 'const m=require("./manifest.json");delete m.stats;delete m.ticks;console.log(require("crypto").createHash("sha256").update(JSON.stringify(m)+"\n").digest("hex"))'
# every shard against the hash the manifest gives it
node -e 'const m=require("./manifest.json");for(const s of [...m.tiers.full.shards,...m.tiers.index.shards])console.log(s.sha256+"  "+s.file)' | sha256sum -c --quiet

The tar is not gzipped on purpose: every data file inside is already gzip, and the files come out
byte-for-byte as they were served, so the manifest's own hashes check them.

CVE snapshot 2026-10-11

The complete published tree of cve-data.carino.systems as it stood on 2026-10-11, kept so that
every number computed from that day — backlog, status mix, enrichment lag — can be computed again by anyone.

snapshot	2026-10-11T13:13:30Z
records	385,745
manifestSha256	b280d8e7420e0b3be41c89abe10adcd5fb50c9310d307f74f414cc74f45e0602
cve-snapshot-2026-10-11.tar	63,447,040 bytes, sha256 e668360e50c5a5fc709f6b30b586846a3b78dbd560027ce765fbe9743c6034ac

manifestSha256 is the hash every tick and every observatory figure cites: the SHA-256 of the
manifest without its stats and ticks keys, re-serialised, plus a newline.

Recomputing it

With curl, not from a browser: release assets redirect without an access-control-allow-origin
header, so no web page can fetch them.

curl -fLO https://github.com/MiguelCarino/CVE-data/releases/download/snapshot-2026-10-11/cve-snapshot-2026-10-11.tar
curl -fLO https://github.com/MiguelCarino/CVE-data/releases/download/snapshot-2026-10-11/SHA256SUMS
sha256sum -c SHA256SUMS
mkdir snapshot && tar -xf cve-snapshot-2026-10-11.tar -C snapshot && cd snapshot
# the manifest hash every figure from this day cites
node -e 'const m=require("./manifest.json");delete m.stats;delete m.ticks;console.log(require("crypto").createHash("sha256").update(JSON.stringify(m)+"\n").digest("hex"))'
# every shard against the hash the manifest gives it
node -e 'const m=require("./manifest.json");for(const s of [...m.tiers.full.shards,...m.tiers.index.shards])console.log(s.sha256+"  "+s.file)' | sha256sum -c --quiet

The tar is not gzipped on purpose: every data file inside is already gzip, and the files come out
byte-for-byte as they were served, so the manifest's own hashes check them.