VulnFlow Free - Public Beta (Core 72.0.102)

VulnFlow Free — Public Beta 72.0.102

72.0.102 is a focused Nessus single-label host-fqdn import correctness patch on the feature-frozen 72.0.72 line. It fixes a defect reproduced from a real public NessusClientData_v2 export without changing SQLite schema 46 or dependency package pins.

Correctness fix

A real Nessus export can contain a valid host IP together with a single-label value such as kali in the host-fqdn HostProperties tag. VulnFlow 72.0.101 copied that scanner value directly into the canonical FQDN field. Canonical FQDN validation correctly rejects names without a dot, so an otherwise valid CVE finding could be rejected during preview even though the host had a valid IP address and hostname.

72.0.102 treats Nessus host-fqdn as canonical FQDN only when it passes the same scanner-adapter FQDN prefilter already used by Greenbone. A single-label value remains available as the asset/hostname label while the canonical FQDN field is left blank, allowing the valid IP-backed finding to normalize and import. Valid fully-qualified Nessus host names are unchanged.

Validation contract

One regression reproduces the real scanner shape with host-fqdn=kali and host-ip=192.168.1.5, verifies that the short label is retained as the asset name, is not promoted to canonical FQDN, and that the CVE finding normalizes and persists successfully. Existing Nessus multi-port and multi-CVE CVSS behavior, Greenbone affected-software/OCI/path identity, and generic import behavior remain unchanged. The public collection contract is 727 tests (78 + 76 + 168 + 80 + 117 + 67 + 141); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.101)

VulnFlow Free — Public Beta 72.0.101

72.0.101 is a focused Greenbone detailed-CSV affected-software identity correctness patch on the feature-frozen 72.0.72 line. It fixes a reproduced scanner-import finding-identity defect without changing SQLite schema 46 or dependency package pins.

Correctness fix

Greenbone's official detailed CSV exports include Affected software/operating system. In 72.0.100 that field was discarded by the CSV adapter. Two rows for the same host, CVE, vulnerability name, and port but different affected software therefore generated the same automatic finding ID; a real batch then failed closed as duplicate finding IDs instead of preserving both observations.

72.0.101 retains the affected-software value in canonical component identity and operator notes. Rows that differ only by affected software remain distinct, while rows without that field keep the historical identity. Existing Greenbone XML path/OCI identity, multi-CVE CVSS/EPSS attribution, Nessus behavior, and generic import behavior are unchanged.

Validation contract

One end-to-end regression verifies that two official-style Greenbone detailed-CSV rows with identical host/CVE/VT/port but different Affected software/operating system values produce distinct component identities, distinct automatic finding IDs, and two persisted findings. Existing Greenbone OCI-image/path and scanner import regressions remain green. The public collection contract is 726 tests (78 + 76 + 168 + 80 + 117 + 67 + 140); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.100)

VulnFlow Free — Public Beta 72.0.100

72.0.100 is a focused Greenbone GMP OCI-image result identity correctness patch on the feature-frozen 72.0.72 line. It fixes a reproduced scanner-import finding-identity defect without changing SQLite schema 46 or dependency package pins.

Defect

Greenbone GMP 22.8 results can include an oci_image object with the image name, digest, registry, repository path, and short name. VulnFlow 72.0.99 preserved host, NVT/CVE, port, and local result path in canonical finding identity, but ignored oci_image. Two valid results for different OCI image digests could therefore normalize to the same scanner finding ID and canonical component when the host, NVT, CVE, port, and local path matched, causing a duplicate finding-id rejection instead of preserving both image findings.

Fix

For Greenbone XML results, 72.0.100 adds the OCI image digest to component identity when available and uses the full image name only as a fallback. OCI image name and digest are also retained in operator notes. Existing Greenbone port/path identity, multi-CVE CVSS/EPSS attribution, Nessus behavior, and generic import behavior are unchanged.

The 72.0.99 Nessus multi-CVE CVSS fail-safe, 72.0.98 Greenbone multi-CVE CVSS attribution, 72.0.97 XML result-path identity, 72.0.96 CSV multi-CVE EPSS fail-safe, 72.0.95 XML per-CVE EPSS attribution, schema 46, and dependency package pins remain unchanged.

Regression contract

One end-to-end regression verifies that two Greenbone GMP results with the same host, NVT, CVE, port, and local path but different OCI image digests produce distinct component identities, distinct automatic finding IDs, and two persisted findings. Existing Greenbone result-path and multi-CVE CVSS regressions remain green. The public collection contract is 725 tests (78 + 76 + 168 + 80 + 117 + 67 + 139); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.99)

VulnFlow Free — Public Beta 72.0.99

72.0.99 is a focused Nessus multi-CVE CVSS attribution correctness patch on the feature-frozen 72.0.72 line. It fixes a reproduced scanner-import risk-score attribution defect without changing SQLite schema 46 or dependency package pins.

Defect

Tenable plugins can reference multiple CVEs while exposing one plugin-level CVSS score in a Nessus ReportItem. VulnFlow 72.0.98 expanded every referenced CVE into its own canonical finding row but copied that one plugin-level CVSS value onto every row. Because the .nessus export does not identify a per-CVE owner for that score, unrelated CVEs could inherit a score that belongs to the plugin as a whole rather than to that individual CVE, changing persisted risk inputs and prioritization.

Fix

For single-CVE Nessus results, 72.0.99 preserves the existing CVSS4, CVSS3, then CVSS2 fallback. For multi-CVE Nessus ReportItem values, per-CVE CVSS is left empty and a parser warning is emitted rather than guessing which CVE owns the plugin-level score.

The 72.0.98 Greenbone multi-CVE CVSS attribution fix, 72.0.97 XML result-path identity fix, 72.0.96 CSV multi-CVE EPSS fail-safe, 72.0.95 XML per-CVE EPSS attribution, generic import behavior, schema 46, and dependency package pins are unchanged.

Regression contract

One end-to-end regression verifies that a multi-CVE Nessus ReportItem expands to all referenced CVEs without copying the plugin-level CVSS, emits the fail-safe warning, normalizes without fabricated per-CVE scores, and persists all findings. Existing single-CVE Nessus CVSS4 and Greenbone multi-CVE CVSS regressions remain green. The public collection contract is 724 tests (78 + 76 + 168 + 80 + 117 + 67 + 138); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.98)

VulnFlow Free — Public Beta 72.0.98

72.0.98 is a focused Greenbone multi-CVE CVSS attribution correctness patch on the feature-frozen 72.0.72 line. It fixes a reproduced scanner-import risk-score attribution defect without changing SQLite schema 46 or dependency package pins.

Defect

Greenbone NVTs can reference multiple CVEs while exposing a single NVT-level cvss_base / result severity derived from the highest-severity referenced CVE. VulnFlow 72.0.97 expanded every referenced CVE into its own canonical finding row but copied that one CVSS value onto every row. A lower-severity CVE could therefore inherit another CVE's higher scanner-supplied CVSS, changing persisted risk inputs and prioritization.

The same ambiguity exists in current detailed Greenbone CSV exports: a row may contain multiple CVE references but does not identify which CVE owns the row-level Severity value.

Fix

For GMP XML, 72.0.98 reuses the representative CVE metadata already present under nvt/epss/max_severity and nvt/epss/max_epss: nested cve@id selects the represented CVE and nested <severity> supplies that CVE's CVSS. Scanner-supplied CVSS is no longer copied to unrelated referenced CVEs. Single-CVE XML retains the historical NVT/result severity fallback.

For detailed Greenbone CSV, single-CVE Severity is preserved. When a row expands to multiple CVEs and no representative CVE ID is available, per-CVE CVSS is left empty and a parser warning is emitted rather than guessing.

The 72.0.97 XML result-path identity fix, 72.0.96 CSV multi-CVE EPSS fail-safe, 72.0.95 XML per-CVE EPSS attribution, Nessus behavior, generic import behavior, schema 46, and dependency package pins are unchanged.

Regression contract

One end-to-end regression verifies XML representative-CVE CVSS attribution through canonical mapping, normalization, batch import, and persisted findings, and verifies detailed CSV multi-CVE CVSS fail-safe warning behavior. The public collection contract is 723 tests (78 + 76 + 168 + 80 + 117 + 67 + 137); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.97)

VulnFlow 72.0.97 — Greenbone XML result path identity

72.0.97 is a Greenbone GMP XML result-path finding-identity correctness patch on the feature-frozen 72.0.72 line. It fixes an independently reproduced scanner-import finding-loss defect without changing SQLite schema 46 or dependency package pins.

Defect

Greenbone GMP result XML can carry a result-level path describing the local path on the scanned host, for example the affected file location. VulnFlow 72.0.96 parsed the result host, port, NVT, CVE and risk/remediation fields but discarded <path>. Two legitimate results with the same asset, CVE, NVT and host-level port but different local paths therefore produced the same canonical component and the same generated finding identity. A batch containing both scanner results could reject the second as a duplicate instead of preserving both findings.

Fix

72.0.97 preserves a non-empty Greenbone XML result <path> in the canonical component identity and operator notes. Existing non-zero numeric port/protocol endpoint identity remains intact, and XML results without a path retain their historical component identity. Greenbone CSV, Nessus, generic imports, per-CVE XML EPSS attribution and multi-CVE CSV EPSS fail-safe behavior are unchanged.

Regression contract

One end-to-end regression verifies two Greenbone XML results with the same asset/CVE/NVT and different local paths, including scanner detection, canonical mapping, generated finding identity, batch import, and two persisted findings. The public collection contract is 722 tests (78 + 76 + 168 + 80 + 117 + 67 + 136); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.96)

VulnFlow 72.0.96 — Greenbone CSV multi-CVE EPSS attribution fail-safe

72.0.96 is a Greenbone detailed-CSV multi-CVE EPSS attribution correctness patch on the feature-frozen 72.0.72 line. It fixes an independently reproduced scanner-import risk-data misattribution defect without changing SQLite schema 46 or dependency package pins.

Defect

Greenbone GMP defines the NVT epss_score/epss_percentile values as the EPSS metrics of the referenced CVE with the highest severity. Current detailed CSV exports expose EPSS score, EPSS percentile, and CVE references, but do not identify which referenced CVE owns that representative EPSS tuple. VulnFlow 72.0.95 expanded a multi-CVE CSV row into one canonical row per CVE and copied the same NVT-level EPSS tuple onto every expanded CVE. A multi-CVE vulnerability test could therefore assign one CVE's exploitation probability and percentile to unrelated CVEs.

Fix

72.0.96 preserves EPSS score/EPSS percentile for single-CVE Greenbone CSV rows. When a CSV row references multiple CVEs, VulnFlow no longer guesses the representative CVE: it leaves per-CVE epss/epss_percentile empty and emits a parser warning. This retains the CVE findings while preventing false risk-data attribution.

72.0.95 Greenbone GMP XML per-CVE attribution remains unchanged because XML provides nested cve@id identifiers for max_severity and max_epss. Existing endpoint identity, solution semantics, Customizable CSV, legacy CSV, Nessus and generic import behavior remain unchanged.

Regression contract

One end-to-end regression verifies a two-CVE current Greenbone detailed CSV row with EPSS fields, including scanner detection, canonical CVE expansion, fail-safe EPSS clearing, parser warning, normalization, batch import, and persisted values. The public collection contract is 721 tests (78 + 76 + 168 + 80 + 117 + 67 + 135); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.95)

VulnFlow 72.0.95 — Greenbone XML per-CVE EPSS attribution

72.0.95 is a Greenbone GMP XML per-CVE EPSS attribution correctness patch on the feature-frozen 72.0.72 line. It fixes an independently reproduced scanner-import risk-data misattribution defect without changing SQLite schema 46 or dependency package pins.

Defect

Greenbone GMP defines nvt/epss/max_severity as EPSS information for the referenced CVE with the highest severity and identifies that representative CVE in the nested cve@id. It separately defines nvt/epss/max_epss as EPSS information for the referenced CVE with the highest EPSS score. VulnFlow 72.0.94 read only the max_severity score/percentile and copied those values onto every canonical CVE row expanded from the NVT. A multi-CVE NVT could therefore assign one CVE's EPSS probability and percentile to a different CVE, distorting prioritization.

Fix

72.0.95 binds each Greenbone XML EPSS tuple to the nested representative cve@id before canonical CVE expansion. max_severity values are assigned only to their representative CVE; max_epss values are preserved for their own representative CVE when different. Other referenced CVEs remain without scanner-supplied EPSS rather than receiving another CVE's value. Single-CVE exports with a missing representative ID retain a safe compatibility fallback.

Existing XML endpoint identity, solution semantics, CSV EPSS behavior, Customizable CSV, Nessus and generic import behavior remain unchanged.

Regression contract

One end-to-end regression verifies a two-CVE Greenbone XML NVT where max_severity and max_epss identify different CVEs, including canonical mapping, normalization, batch import, and persisted per-CVE EPSS values. The public collection contract is 720 tests (78 + 76 + 168 + 80 + 117 + 67 + 134); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.94)

VulnFlow 72.0.94 — Greenbone XML EPSS preservation

72.0.94 is a current Greenbone GMP XML risk-intelligence preservation correctness patch on the feature-frozen 72.0.72 line. It fixes an independently reproduced scanner-import data-loss defect without changing SQLite schema 46 or dependency package pins.

Defect

Current Greenbone GMP result NVTs may include epss/max_severity/score and epss/max_severity/percentile, representing EPSS information for the referenced CVE with the highest severity. VulnFlow 72.0.93 preserved the current detailed CSV EPSS fields but the OpenVAS XML adapter ignored the GMP XML EPSS structure. A valid result containing score=0.82 and percentile=0.99 therefore lost both canonical EPSS inputs during XML import.

Fix

72.0.94 preserves nvt/epss/max_severity/score as canonical epss and nvt/epss/max_severity/percentile as canonical epss_percentile. It intentionally follows Greenbone's max_severity EPSS contract rather than substituting max_epss. Existing XML CVE references, endpoint identity, solution semantics, CSV EPSS behavior, Customizable CSV, Nessus and generic import behavior remain backward compatible.

Regression contract

One end-to-end regression verifies Greenbone XML parsing, max_severity EPSS score/percentile extraction, canonical mapping, normalization, batch import, and persisted values. The public collection contract is 719 tests (78 + 76 + 168 + 80 + 117 + 67 + 133); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.

VulnFlow Free - Public Beta (Core 72.0.93)

VulnFlow 72.0.93 — Greenbone EPSS preservation

72.0.93 is a current Greenbone detailed CSV risk-intelligence preservation correctness patch on the feature-frozen 72.0.72 line. It fixes an independently reproduced scanner-import data-loss defect without changing SQLite schema 46 or dependency package pins.

Defect

Current Greenbone OPENVAS SECURITY INTELLIGENCE/OPENVAS REPORT detailed CSV exports include EPSS score and EPSS percentile. VulnFlow 72.0.92 correctly recognized the current Greenbone detailed CSV profile and preserved CVE/endpoint identity, but the OpenVAS CSV adapter did not copy either EPSS field into canonical import rows. A source row containing EPSS score=0.82 and EPSS percentile=0.99 therefore reached normalization with empty EPSS values and was persisted as zero, silently changing prioritization input.

Fix

72.0.93 preserves EPSS score as canonical epss and EPSS percentile as canonical epss_percentile. The existing canonical import mapping contract now exposes epss_percentile, which already exists in schema 46. Existing Greenbone CVE references, endpoint identity, Customizable CSV, XML, Nessus and generic import behavior remain backward compatible.

Regression contract

One end-to-end regression verifies current detailed CSV auto-detection, EPSS score/percentile extraction, canonical mapping, normalization, batch import, and persisted values. The public collection contract is 718 tests (78 + 76 + 168 + 80 + 117 + 67 + 132); platform-specific skips remain explicit.

SQLite schema remains 46 and dependency package pins are unchanged.