When our system identifies a security risk, we provide detailed context by linking the issue to the global standard for vulnerability tracking: **Common Vulnerabilities and Exposures (CVE)**.

## **The Linking Process**

For this enrichment to work, a detected vulnerability must first contain a specific reference to a CVE ID (e.g., `CVE-2023-12345`). Once this reference is established, our system automatically initiates a correlation process.

Instead of relying on a single database, we cross-reference the CVE ID against a massive aggregation of external security sources, vendor bulletins, and advisory feeds. This ensures that the information you see is not just a static error code, but a comprehensive summary of the vulnerability as understood by the global security community.

### **National Vulnerability Databases**

* [NVD CVE](https://nvd.nist.gov/) importer (API 2.0), with [Fraunhofer FKIE NVD JSON feeds](https://github.com/fkie-cad/nvd-json-data-feeds)

* [China National Vulnerability Database (CNNVD)](https://www.cnnvd.org.cn/)

* [JVN iPedia](https://jvndb.jvn.jp/) – Japanese vulnerability countermeasure database

* CERT-FR [Alerts](https://www.cert.ssi.gouv.fr/alerte/) and [Advisories](https://www.cert.ssi.gouv.fr/avis/)

* [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

* [CNW (EU CSIRTs network) Known Exploited Vulnerabilities](https://github.com/enisaeu/CNW)

### **Community & Open Source Databases**

* [CVE Project – cvelist](https://github.com/CVEProject/cvelist)

* [Cloud Security Alliance – GSD Database](https://github.com/cloudsecurityalliance/gsd-database/)

* [GitHub Advisory Database](https://github.com/github/advisory-database)

* [PySec Advisory Database](https://github.com/pypa/advisory-database)

* [OpenSSF Malicious Packages](https://github.com/ossf/malicious-packages)

### **CSAF-based Sources**

* [ABB](https://global.abb/group/en/technology/cyber-security/alerts-and-notifications)

* [CERT-Bund](https://wid.cert-bund.de/portal/wid/start)

* [CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

* [Cisco](https://www.cisco.com/)

* [Nozomi Networks](https://security.nozominetworks.com/)

* [Open-Xchange](https://www.open-xchange.com/)

* [Red Hat](https://access.redhat.com/security/)

* [Sick](https://www.sick.com/psirt)

* [Siemens](https://www.siemens.com/global/en/products/services/cert.html)

* [NCSC-NL](https://advisories.ncsc.nl/)

* [Microsoft](https://msrc.microsoft.com/)