Alexandre Dulaunoy

Before submitting one or more talks to @passthesaltcon@infosec.exchange 2026, I wrote a blog post based on my 2024 presentation: Bring Back RSS for Operational Security.

#rss #infosec #cybersecurity #cti #threatintel #osint #opensource #atom

https://www.foo.be/2026/03/bring-back-rss

cpe-guesser 2.0 released - Multi-Source CPE Imports, Better Ranking, and Greater Autonomy Beyond NVD

Version 2.0 brings major improvements to CPE import, ranking, and CVE v5 data handling. This release focuses on better import performance, broader format support, improved search relevance, and more robust indexing for vendor and product matching.

A notable change in this release is that cpe-guesser is no longer limited to NVD as its only practical CPE source. In addition to the NVD feeds, it can also leverage the Vulnerability-Lookup dump available at https://vulnerability.circl.lu/dumps/ , providing additional CPE sources and more autonomy from the previously NVD-only source model.

This release lays an important foundation for improving the GCVE ecosystem, especially by strengthening vendor and product references through better CPE source diversity, indexing, and matching capabilities. If you have ideas for further improvements, additional data sources, or better ways to refine vendor and product identification, we would be very happy to hear your feedback.

https://www.vulnerability-lookup.org/2026/03/22/cpe-guesser-2.0-released/

https://github.com/vulnerability-lookup/cpe-guesser

@circl@social.circl.lu
@gcve@social.circl.lu

#gcve #cve #opensource #cpe #vulnerability #vulnerabilitymanagement

gcve-eu-kev updated — a CISA KEV and ENISA CNW/EUVD to GCVE BCP-07 converter.

It now also includes a generic RSS/Atom exporter for any GCVE KEV BCP-07 feed.

@gcve@social.circl.lu

#cybersecurity #gcve #kev #cve #vulnerability #vulnerabilitymanagement

🔗 https://github.com/gcve-eu/gcve-eu-kev
🔗 https://gcve.eu/bcp/gcve-bcp-07/

I just published The Open Contributions Descriptor format as an IETF Internet-Draft.

#opensource #opendata #openstandard

https://datatracker.ietf.org/doc/draft-dulaunoy-open-contributions-descriptor/

A new pull request for Vulnerability-Lookup adds a CSAF producer that publishes advisories for many manufacturers.

This is great for defenders and researchers, as it increases the amount of detailed vulnerability information available.

It will push the number of ingested feeds to more than 50 unique sources, highlighting the growing diversity of our data sources.

If someone tells you there is a single source of truth for vulnerability information, they’re ignoring the reality: vulnerability intelligence comes from many different sources.

Thanks to @rafi0t@social.yoyodyne-it.eu for the continuous work on adding CSAF and feeds to vulnerability-lookup

#gcve #cve #cybersecurity #csaf #vulnerability #opendata #opensource

🔗 The new PR with many new CSAF sources https://github.com/vulnerability-lookup/vulnerability-lookup/pull/348
🔗 The open source vulnerability-lookup software https://www.vulnerability-lookup.org/
🔗 GCVE instance https://db.gcve.eu/

@gcve@social.circl.lu
@cedric@fosstodon.org

Have you ever tried doing digital forensics using an SBOM or even just gathering evidence for a technical investigation from one? No file hashes, a single cryptographic signature covering an arbitrary set of files, and often missing full paths or permissions. Many SBOM standards need a serious revamp if they are to support DFIR use cases #dfir #sbom #openstandard

I hate Discord. The platform is proprietary, the U/X is just completely confusing and it's difficult to find anything.

If you run a project, I love @Discourse@mastodon.social - it's open source, the U/X is great and you can archive everything in markdown (and much more).

https://github.com/discourse/discourse
and we run it for GCVE https://discourse.ossbase.org/c/gcve/14

#opensource #discourse

A new open source cyber-range platform released at the @oscl@mastodon.opencloud.lu and presented at the cybersecurity track.

https://github.com/range42

It seems very promising.

@SteveClement@infosec.exchange @hyd3@infosec.exchange

#cyberrange #cybersecurity #opensource