v2026.11.02 — cvelistV5 2026-11-02 snapshot

Data refresh — cvelistV5 2026-11-02. No code changes beyond the snapshot pin;
the pipeline is the one that built v2026.09.30.

What moved

Query	v2026.09.30	Now
product='internet explorer'	1,077	1,077
vendor='aruba', product='clearpass'	187	215
vendor='citrix'	359	366
vendor='cisco'	6,139	6,215
vendor='vmware'	1,177	1,116

vendor='vmware' went down, and that's the vendor index working as built.
All 74 CVEs that dropped out are RabbitMQ. NVD has since re-analysed them with
version-specific broadcom CPEs, so rabbitmq-server now carries 216 broadcom
CPE rows against 5 vmware ones. The vmware slug falls under the 5% share floor
that keeps strays out of vendor search. They are still found by rabbitmq and
broadcom. The same rebuild stopped Adobe's Content Credentials SDKs matching
microsoft/google/linux.

Placeholder-product recovery resolved 99,755 n/a CVEs (was 99,389).

Data snapshot — 2026-11-02

Source	Count
CVEs (cvelistV5 2026-11-02, + 1 KEV-only stub)	417,700
NVD enrichment	417,699 merged
CPE match rows	3,237,390 (323,437 CVEs)
EPSS scored	398,815
OSV package data	17,745 CVEs
CISA KEV listed	1,766 (catalog 2026.10.30)
KEV with known ransomware use	361
Nuclei templates	4,670 artefacts
Exploit-DB entries	30,352 artefacts
Metasploit modules	3,602 artefacts
Total exploit artefacts	38,624
Vendors	45,471
Products	116,655
Product/CPE-vendor index	50,282 rows

EPSS gaps are CVEs FIRST hasn't scored (overwhelmingly rejected records; 26 live
ones). DB size: 2.25 GiB raw → 655 MiB zstd-compressed. FTS5 and
product_cpe_vendor are pre-built.

Upgrading

Drop-in. Download and decompress as usual:

gh release download -R mez-0/vulnify --pattern vulnify.db.zst
zstd -d vulnify.db.zst -o vulnify.db

v2026.09.30 — cvelistV5 2026-09-30 snapshot, product identity for n/a CVEs

New data snapshot — cvelistV5 2026-09-30 — plus a fix that makes ~99k CVEs
reachable by product name for the first time, and a run of pipeline and data
fixes found while building it.

Product identity for placeholder CVEs

CNAs routinely write product: n/a. The ingest filtered placeholder vendors
but kept placeholder products verbatim, so 40% of CVEs with an affected
product sat on a product literally named n/a — unreachable by any product
search, KEV entries with public exploits among them.

A new placeholder_products phase recovers the identity from NVD's CPE 2.3
strings, per CVE. 99,389 CVEs resolved; CVEs whose CPEs name several
products (multi-product advisories) are deliberately left alone rather than
pinned to one of them.

Names are stored the way people type them (internet explorer, not
internet_explorer), and a CPE slug that respells an existing vendor
(hitachivantara) lands on that vendor instead of creating a twin.

Query	v2026.07.25.1	Now
product='internet explorer'	—	1,077
vendor='aruba', product='clearpass'	152	187
vendor='citrix'	195	359
vendor='vmware'	914	1,177
vendor='cisco'	4,103	6,139

(The deltas include two months of new CVEs as well as the fix.)

New flag: --skip-placeholder-products.

Pipeline fixes

• NVD and KEV now heal after an ingest. Ingestion cascade-wipes
  cpe_match, cvss and kev; only the exploit phases were told to ignore
  their watermarks. An incremental NVD refresh re-fetched only what NVD had
  changed, and left cpe_match at 169k of 1.3M rows. A gather that ran
  ingestion now does a full NVD backfill and re-ingests KEV.
• Nuclei watermark reflects the tarball parsed. It came from upstream HEAD
  while the parse used a cache with no expiry, so a stale corpus could be
  recorded as current and a fresh one then skipped. It now reads the commit
  git archive embeds in the tarball.
• Upstream caches expire. The exploit-corpus cache had no expiry and had
  been serving 2026-06-19 corpora — the previous release shipped them too. Copies
  are now refreshed once a day old, and this release parses current Nuclei /
  Exploit-DB / Metasploit. The cvelistV5 zip cache now records which snapshot
  it holds, so bumping the pin can't silently re-ingest an old one.
• KEV no longer strips exploit evidence. Catalog entries were merged by
  deleting and rebuilding each CVE, which took its exploit artefacts with it on
  any run that didn't re-parse the corpora afterwards. KEV now merges in place,
  and fetches the catalog itself instead of needing a file dropped in by hand.
• ransomware_usage is populated. CISA publishes Known / Unknown; the
  parser matched yes, so the flag was false on every KEV entry. 361 are
  now flagged.
• EPSS "not scored" is NULL, not 0.0. 18,964 CVEs FIRST hasn't scored
  (mostly rejected) previously read as scored-and-negligible, and
  database_overview counted them as having EPSS. Existing databases are
  corrected by a migration on first open.

Data snapshot — 2026-09-30

Source	Count
CVEs (cvelistV5 2026-09-30, + 1 KEV-only stub)	399,490
NVD enrichment	399,489 merged
CPE match rows	3,188,736 (318,319 CVEs)
EPSS scored	380,526
OSV package data	16,691 CVEs
CISA KEV listed	1,730 (catalog 2026.09.30)
KEV with known ransomware use	361
Nuclei templates	4,560 artefacts
Exploit-DB entries	30,346 artefacts
Metasploit modules	3,575 artefacts
Total exploit artefacts	38,481
Vendors	44,420
Products	113,445
Product/CPE-vendor index	50,085 rows

Vendors and products grow because resolved placeholder CVEs now carry real
identities. DB size: 2.08 GiB raw → 549 MiB zstd-compressed. FTS5 and
product_cpe_vendor are pre-built.

Upgrading

Drop-in. Download and decompress as usual:

gh release download -R mez-0/vulnify --pattern vulnify.db.zst
zstd -d vulnify.db.zst -o vulnify.db

v2026.07.25.1

Code patch against the 2026-07-24 cvelistV5 snapshot (same data as
v2026.07.25). Fixes a vendor-filter bug that made search_cves return a
confident empty set, and adds a vendor-discovery tool.

The bug

Pinning a vendor returned nothing for products that have CVEs:

search_cves(product='clearpass', vendor='aruba')  ->  0 rows
search_cves(product='clearpass', vendor=None)     -> 20 rows   (152 total)

The cause is upstream and far wider than one vendor. cvelistV5 CNAs routinely
write vendor: n/a while still naming the product, so the ingest kept the
product and dropped the vendor — collapsing 8,804 products (11%) and 164,186
CVEs (44% of the corpus) onto a single empty-named placeholder vendor row that
no name filter can ever match. Separately, the vendor and product filters
were independent joins, so vendor="cisco", product="ios" matched a CVE that
named Cisco and, unrelatedly, listed an Apple product called iOS.

For a vulnerability lookup a confident empty set is the worst possible failure —
the caller cannot tell "wrong vendor string" from "no CVEs exist".

The fix

Uses a signal that was already in the database and unparsed: the vendor
component of NVD's CPE 2.3 strings. A CVE now matches vendor=X if any of
its vendor edges, its affected products' owning vendor, the product name itself,
or the product's CPE vendor slug matches — and when vendor and product are
both given they must describe the same affected product.

Query	Before	After
vendor='aruba', product='clearpass'	0	152
vendor='vmware'	253	914
vendor='citrix'	41	195
vendor='cisco'	3,260	4,103
vendor='fortinet'	986	1,010

This is deliberately broad: vendor="vmware" also returns Lenovo's "LXCI for
VMware". Over-returning is recoverable; a false empty set is not.

New tool: list_vendors(query, limit)

Vendor names with their CVE and product counts plus NVD's CPE spellings, so an
agent can check what a term actually matched. list_vendors("aruba") returns
only Aruba.it / arubadev / Aruba with 1-3 CVEs each — all the Italian
hosting company — while list_vendors("hewlett") shows
Hewlett Packard Enterprise carrying the arubanetworks CPE slug. The link
comes out of the data rather than a hand-maintained alias list.

Also in this release

• New derived table product_cpe_vendor (35,619 rows), pre-built in the
  shipped DB so vulnify-mcp serves immediately instead of spending ~40s
  building it on first start.
• 2,691 products moved off the placeholder vendor onto the vendor their CPE
  evidence names (8,804 → 6,113), and 487 duplicate product rows merged. No
  CVE, affected-product or version-range rows lost.
• Two missing indexes added — cve_vendor(vendor_id) and
  affected_product(product_id). The first took list_vendors from over 300s
  to 0.07s.
• New vendor_index pipeline phase, with --skip-vendor-index.
• Test suite 73 → 98.

Data snapshot — 2026-07-24

Source	Count
CVEs (cvelistV5 2026-07-24)	369,943
NVD enrichment	352,167 merged
EPSS scored	352,241
OSV package data	12,578 CVEs
CISA KEV listed	1,653
Nuclei templates	4,269 artefacts
Exploit-DB entries	30,291 artefacts
Metasploit modules	3,520 artefacts
Total exploit artefacts	38,080
Products	77,652
Product/CPE-vendor index	35,619 rows

DB size: 2.08 GB raw → 482 MiB zstd-compressed.

Upgrading

Drop-in. Download and decompress as usual:

gh release download -R mez-0/vulnify --pattern vulnify.db.zst
zstd -d vulnify.db.zst -o vulnify.db

Existing databases are migrated in place on first open — the vendor index is
derived from tables already present, so no re-gather and no network is needed,
though the one-off build costs ~40s. Restart your agent to pick up
list_vendors (MCP servers attach at session start).

v2026.07.25

Data snapshot — 2026-07-25

Source	Count
CVEs (cvelistV5 2026-07-24)	369,943
NVD enrichment	352,167 merged
EPSS scores	369,943
OSV package data	12,578 CVEs
Nuclei templates	4,269 artefacts
Exploit-DB entries	30,571 artefacts
Metasploit modules	3,520 artefacts
Total exploit artefacts	38,080

DB size: 2.1 GB raw → 441 MB zstd-compressed.

Not included

• CISA KEV (no local catalog configured this run)

vulnify v2026.06.10

A fully-populated CVE knowledge base: 347,248 CVEs stitched from CVEProject, NVD, CISA KEV, EPSS, OSV, and the Nuclei / Exploit-DB / Metasploit exploit corpora, exposed to agents over an MCP server and browsable in a bundled Streamlit explorer.

This is a point-in-time snapshot — rebuild for fresher data.

This snapshot

	count
CVEs	347,248
KEV-listed	1,593
Exploit artefacts	37,972
Vendors	21,142
Products	70,266

• CVE data spans 1999-09-29 to 2026-04-30 (cvelistV5 snapshot).
• Enrichment last ran 2026-06-10 (NVD, EPSS, OSV, Nuclei, Exploit-DB, Metasploit).
• The FTS5 full-text index is pre-built, so vulnify-mcp serves immediately on first start.

Assets

• vulnify.db.zst — the full SQLite database, zstd-compressed. Decompress with zstd -d vulnify.db.zst.
• schema.sql — the DDL, if you only want the structure.

Quick start

gh release download -R mez-0/vulnify --pattern vulnify.db.zst
zstd -d vulnify.db.zst -o vulnify.db
echo "VULNIFY_SQLITE_PATH=$(pwd)/vulnify.db"        > .env
echo "VULNIFY_SCHEMA_SQL_PATH=vulnify/db/schema.sql" >> .env
uv sync --extra mcp
uv run vulnify-mcp </dev/null   # smoke test

See the README for MCP client setup (Claude Code, Claude Desktop, Cursor).