|
1 | | -# Feed syndication |
2 | | - |
3 | | -## Available feeds |
4 | | - |
5 | | -| Endpoint | Methods | Rule | Comment | |
6 | | -|----------|---------|------|---------| |
7 | | -| bundles_bp.feed_bundles | GET | /bundles/feed.\<string:format\>[?user=\<login\>] | Recent bundles. | |
8 | | -| comments_bp.feed_comments | GET | /comments/feed.\<string:format\>[?user=\<login\>] | Recent comments. | |
9 | | -| user_bp.feed_activity | GET | /user/\<string:login\>.\<string:format\> | Recent user activity. | |
10 | | -| home_bp.feed_recent | GET | /recent/\<string:source\>.\<string:format\>[?vulnerability=\<vuln-id\>][?vendor=\<vendor-id\>] | Recent vulnerabilities per source or for all sources. Argument `vulnerability` is used to generate a feed of linked vulnerabilities. Argument `vendor` is used to generate a feed of vulnerabilities for the specified vendor. | |
11 | | -| sightings_bp.feed_sightings | GET | /sightings/feed.\<string:format\> | Recent sightings. | |
12 | | -| sightings_bp.feed_cpe_search | GET | /sightings/cpesearch/\<string:cpe\>/feed.\<string:format\> | Recent sightings for all vulnerabilities related to a CPE. | |
| 1 | +# Feed syndication (RSS / Atom) |
| 2 | + |
| 3 | +Vulnerability-Lookup exposes RSS and Atom feeds for new vulnerabilities, |
| 4 | +sightings, comments, bundles, and individual user activity. Feeds are |
| 5 | +designed for low-volume, human-facing consumers — RSS readers, chat-room |
| 6 | +bots, alert pipes, dashboards — where a small set of recent items is |
| 7 | +enough. |
| 8 | + |
| 9 | +```{tip} |
| 10 | +Building a mirror, scanner, or other large-scale automated consumer? |
| 11 | +Feeds are not the right tool — paginated history is capped per feed. |
| 12 | +See [Access patterns for automated consumers](access-patterns.md) for |
| 13 | +the canonical sync path (`since=` over the [API](api-v1.md), plus the |
| 14 | +pub/sub stream where the operator enables it). |
| 15 | +``` |
13 | 16 |
|
14 | | -The value of `format` can be `rss` or `atom`. |
| 17 | +## Available endpoints |
15 | 18 |
|
16 | | -The value of `source` can be `all` or any of the individual source identifiers configured in your instance. |
| 19 | +| Path | Purpose | |
| 20 | +| --- | --- | |
| 21 | +| `/recent/{source}.{format}` | Recent vulnerabilities, per source or across all sources. Optional `?vendor={vendor-id}` filters by vendor; optional `?vulnerability={vuln-id}` returns vulnerabilities linked to the given one. | |
| 22 | +| `/sightings/feed.{format}` | Recent sightings (across all vulnerabilities). Optional `?vulnerability={vuln-id}` narrows to a single vulnerability. | |
| 23 | +| `/sightings/cpesearch/{cpe}/feed.{format}` | Recent sightings for any vulnerability affecting the given CPE. | |
| 24 | +| `/comments/feed.{format}` | Recent comments. Optional `?user={login}` narrows to one author. | |
| 25 | +| `/bundles/feed.{format}` | Recent bundles. Optional `?user={login}` narrows to one author. | |
| 26 | +| `/user/{login}.{format}` | Recent activity (sightings, comments, bundles) for a given user. | |
17 | 27 |
|
18 | | -Default sources include: |
| 28 | +### `{format}` |
19 | 29 |
|
20 | | -**Core:** |
21 | | -"cvelistv5", "nvd", "fkie_nvd", "github", "pysec", "gsd", "vulnrichment" |
| 30 | +Either `rss` or `atom`. Both contain the same items; pick whichever your |
| 31 | +reader prefers. |
22 | 32 |
|
23 | | -**Community & National databases:** |
24 | | -"jvndb", "cnvd", "fstec", "variot", "tailscale", "bitnami_vulndb", "cleanstart", "drupal", |
25 | | -"ossf_malicious_packages", "emb3d" |
| 33 | +### `{source}` |
26 | 34 |
|
27 | | -**CERT-FR:** |
28 | | -"certfr_avis", "certfr_alerte" |
| 35 | +Either `all`, or any source identifier configured on this instance. The |
| 36 | +authoritative list for a given deployment is exposed on `/about` and on |
| 37 | +[https://www.vulnerability-lookup.org/sources](https://www.vulnerability-lookup.org/sources). |
| 38 | +Common identifiers shipped by default include: |
29 | 39 |
|
30 | | -**CSAF providers:** |
31 | | -"csaf_abb", "csaf_certbund", "csaf_cisa", "csaf_cisco", "csaf_microsoft", "csaf_ncscnl", |
32 | | -"csaf_nozominetworks", "csaf_opensuse", "csaf_ox", "csaf_redhat", "csaf_se", "csaf_sick", |
33 | | -"csaf_siemens", "csaf_suse", "csaf_trustsource" |
| 40 | +- **Core:** `cvelistv5`, `nvd`, `fkie_nvd`, `github`, `pysec`, `gsd`, `vulnrichment` |
| 41 | +- **Community & national databases:** `jvndb`, `cnvd`, `fstec`, `variot`, `tailscale`, `bitnami_vulndb`, `cleanstart`, `drupal`, `ossf_malicious_packages`, `emb3d` |
| 42 | +- **CERT-FR:** `certfr_avis`, `certfr_alerte` |
| 43 | +- **CSAF providers:** `csaf_abb`, `csaf_certbund`, `csaf_cisa`, `csaf_cisco`, `csaf_microsoft`, `csaf_ncscnl`, `csaf_nozominetworks`, `csaf_opensuse`, `csaf_ox`, `csaf_redhat`, `csaf_se`, `csaf_sick`, `csaf_siemens`, `csaf_suse`, `csaf_trustsource` |
| 44 | +- **OSV:** `osv_almalinux`, `osv_haskell`, `osv_ocaml`, `osv_ossfuzz`, `osv_rustsec` |
| 45 | +- **Enrichment:** `cwec`, `capec` |
34 | 46 |
|
35 | | -**OSV:** |
36 | | -"osv_almalinux", "osv_haskell", "osv_ocaml", "osv_ossfuzz", "osv_rustsec" |
| 47 | +### Pagination |
37 | 48 |
|
38 | | -**Enrichment:** |
39 | | -"cwec", "capec" |
| 49 | +Feeds accept `page` and `per_page` query parameters. The default page |
| 50 | +size is set per instance via `FEED_MAX_PER_PAGE` in `config/website.py`. |
| 51 | +Most readers don't paginate, so the default is sized for one page of |
| 52 | +recent items. |
40 | 53 |
|
41 | 54 | ## Examples |
42 | 55 |
|
43 | | -### Recent vulnerabilities from all sources |
| 56 | +### Subscribing to recent vulnerabilities |
| 57 | + |
| 58 | +All sources, Atom format: |
44 | 59 |
|
45 | 60 | ```bash |
46 | 61 | $ curl https://vulnerability.circl.lu/recent/all.atom |
47 | 62 | ``` |
48 | 63 |
|
49 | | -### Recent vulnerabilities from pysec |
| 64 | +A single source: |
50 | 65 |
|
51 | 66 | ```bash |
52 | 67 | $ curl https://vulnerability.circl.lu/recent/pysec.atom |
53 | 68 | ``` |
54 | 69 |
|
55 | | -### Recent vulnerabilities related to a vendor |
| 70 | +### Filtering recent vulnerabilities |
| 71 | + |
| 72 | +By vendor: |
56 | 73 |
|
57 | 74 | ```bash |
58 | 75 | $ curl 'https://vulnerability.circl.lu/recent/cvelistv5.atom?vendor=MISP&per_page=2&page=8' |
59 | | -<?xml version='1.0' encoding='UTF-8'?> |
60 | | -<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en"> |
61 | | -<id>https://vulnerability.circl.lu/rss/recent/cvelistv5/2</id> |
62 | | -<title>Most recent entries from cvelistv5</title> |
63 | | -<updated>2024-11-26T08:02:41.668408+00:00</updated> |
64 | | -<author> |
65 | | - <name>Vulnerability-Lookup</name> |
66 | | - <email>info@circl.lu</email> |
67 | | -</author> |
68 | | -<link href="https://vulnerability.circl.lu" rel="alternate"/> |
69 | | -<generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator> |
70 | | -<subtitle>Contains only the most 2 recent entries.</subtitle> |
71 | | -<entry> |
72 | | - <id>https://vulnerability.circl.lu/vuln/cve-2021-37534</id> |
73 | | - <title>cve-2021-37534</title> |
74 | | - <updated>2024-11-26T08:02:41.670402+00:00</updated> |
75 | | - <link href="https://vulnerability.circl.lu/vuln/cve-2021-37534"/> |
76 | | -</entry> |
77 | | -<entry> |
78 | | - <id>https://vulnerability.circl.lu/vuln/cve-2022-29528</id> |
79 | | - <title>cve-2022-29528</title> |
80 | | - <updated>2024-11-26T08:02:41.670364+00:00</updated> |
81 | | - <link href="https://vulnerability.circl.lu/vuln/cve-2022-29528"/> |
82 | | -</entry> |
83 | | -</feed> |
84 | 76 | ``` |
85 | 77 |
|
86 | | -### Recent vulnerabilities linked to the specified vulnerability |
| 78 | +Vulnerabilities linked to a specific vulnerability (e.g. cross-source |
| 79 | +correlation, follow-ups): |
87 | 80 |
|
88 | 81 | ```bash |
89 | 82 | $ curl 'https://vulnerability.circl.lu/recent/all.atom?vulnerability=cve-2021-22280' |
| 83 | +``` |
| 84 | + |
| 85 | +Sample response: |
| 86 | + |
| 87 | +```xml |
90 | 88 | <?xml version='1.0' encoding='UTF-8'?> |
91 | 89 | <feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en"> |
92 | | -<id>https://vulnerability.circl.lu/rss/recent/all/10</id> |
93 | | -<title>Most recent entries from all</title> |
94 | | -<updated>2024-11-26T08:03:09.000211+00:00</updated> |
95 | | -<author> |
| 90 | + <id>https://vulnerability.circl.lu/rss/recent/all/10</id> |
| 91 | + <title>Most recent entries from all</title> |
| 92 | + <updated>2024-11-26T08:03:09.000211+00:00</updated> |
| 93 | + <author> |
96 | 94 | <name>Vulnerability-Lookup</name> |
97 | 95 | <email>info@circl.lu</email> |
98 | | -</author> |
99 | | -<link href="https://vulnerability.circl.lu" rel="alternate"/> |
100 | | -<generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator> |
101 | | -<subtitle>Contains only the most 10 recent entries.</subtitle> |
102 | | -<entry> |
| 96 | + </author> |
| 97 | + <link href="https://vulnerability.circl.lu" rel="alternate"/> |
| 98 | + <subtitle>Contains only the most 10 recent entries.</subtitle> |
| 99 | + <entry> |
103 | 100 | <id>https://vulnerability.circl.lu/vuln/ghsa-x53h-2cjp-mwcx</id> |
104 | 101 | <title>ghsa-x53h-2cjp-mwcx</title> |
105 | 102 | <updated>2024-11-26T08:03:09.013675+00:00</updated> |
106 | 103 | <link href="https://vulnerability.circl.lu/vuln/ghsa-x53h-2cjp-mwcx"/> |
107 | | -</entry> |
108 | | -<entry> |
109 | | - <id>https://vulnerability.circl.lu/vuln/gsd-2021-22280</id> |
110 | | - <title>gsd-2021-22280</title> |
111 | | - <updated>2024-11-26T08:03:09.013602+00:00</updated> |
112 | | - <link href="https://vulnerability.circl.lu/vuln/gsd-2021-22280"/> |
113 | | -</entry> |
| 104 | + </entry> |
| 105 | + <!-- ... --> |
114 | 106 | </feed> |
115 | 107 | ``` |
116 | 108 |
|
117 | | -### Subscribing to the activity related to a vulnerability |
| 109 | +### Subscribing to sightings |
118 | 110 |
|
119 | | -The request will return recent observations (sightings) related to a vuln. |
| 111 | +For a specific vulnerability: |
120 | 112 |
|
121 | 113 | ```bash |
122 | 114 | $ curl 'https://vulnerability.circl.lu/sightings/feed.atom?vulnerability=CVE-2024-0012' |
123 | 115 | ``` |
124 | 116 |
|
125 | | -### Recent sightings related to a product |
| 117 | +For every vulnerability affecting a product (CPE): |
126 | 118 |
|
127 | 119 | ```bash |
128 | 120 | $ curl 'https://vulnerability.circl.lu/sightings/cpesearch/cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:*/feed.atom' |
129 | 121 | ``` |
130 | 122 |
|
131 | | -This will return recent sightings related to all CVEs for the specified product (identified by its CPE identifier). |
132 | | -Sightings are based on information from various trusted sources, including security websites, Exploit-DB.com, GitHub repositories, security blogs, social networks, and MISP. |
| 123 | +Sightings are aggregated from various trusted sources, including security |
| 124 | +websites, Exploit-DB, GitHub repositories, security blogs, social |
| 125 | +networks, and MISP. |
| 126 | + |
| 127 | +### Subscribing to comments, bundles, or user activity |
| 128 | + |
| 129 | +Recent comments across the instance: |
| 130 | + |
| 131 | +```bash |
| 132 | +$ curl https://vulnerability.circl.lu/comments/feed.atom |
| 133 | +``` |
| 134 | + |
| 135 | +Comments by a single user: |
| 136 | + |
| 137 | +```bash |
| 138 | +$ curl 'https://vulnerability.circl.lu/comments/feed.atom?user=alice' |
| 139 | +``` |
| 140 | + |
| 141 | +Recent activity for a single user (sightings + comments + bundles in one |
| 142 | +feed): |
| 143 | + |
| 144 | +```bash |
| 145 | +$ curl https://vulnerability.circl.lu/user/alice.atom |
| 146 | +``` |
| 147 | + |
| 148 | +## See also |
| 149 | + |
| 150 | +- [API v1](api-v1.md) — paginated, programmatic access including |
| 151 | + `since=`-based incremental sync, cross-source correlation, and the |
| 152 | + full OpenAPI specification. |
| 153 | +- [Access patterns for automated consumers](access-patterns.md) — |
| 154 | + authoritative guidance on which surface to use for which use case |
| 155 | + (feeds vs. API vs. stream vs. bulk dumps), identification etiquette, |
| 156 | + and rate-limit posture. |
0 commit comments