Data sources

Russia's Data Security Threats Database (БДУ), operated by FSTEC — the sovereign Russian vulnerability catalogue, including flaws with no assigned CVE.

Source: FSTEC BDU (Russia). Republished as factual vulnerability data; no licence is granted by the source.

CERT-Bund, Germany's national CERT at the BSI — publishes CSAF 2.0 security advisories (WID-SEC-…) coordinating vendor and product vulnerabilities.

Quelle: BSI CERT-Bund. Free for non-commercial re-use with source acknowledgement; commercial re-use requires a separate BSI agreement.

CISA's machine-readable CSAF 2.0 advisories for information technology (VA series).

US Government work, public domain. Courtesy attribution to CISA.

CISA's machine-readable CSAF 2.0 advisories for operational technology — ICS (ICSA) and ICS medical (ICSMA) advisories.

US Government work, public domain. Courtesy attribution to CISA.

CISA's Known Exploited Vulnerabilities catalogue — CVEs with confirmed in-the-wild exploitation, each carrying a U.S. federal remediation due date.

US Government work, public domain. Courtesy attribution to CISA.

CISA's Vulnrichment program — SSVC decision points (Exploitation, Automatable, Technical Impact) added to CVE records via CISA's ADP container, for U.S. federal remediation prioritisation.

US Government work, public domain. Courtesy attribution to CISA.

China's National Vulnerability Database of Information Security (国家信息安全漏洞库), operated under CNITSEC — including flaws catalogued with no assigned CVE.

Source: CNNVD / CNITSEC (China). Republished as factual vulnerability data; no licence is granted by the source.

MITRE Center for Threat-Informed Defense mappings of CISA KEV (known-exploited) CVEs to the MITRE ATT&CK techniques they enable — the bridge from a vulnerability to adversary behaviour.

© Center for Threat-Informed Defense. Licensed under Apache-2.0; incorporates MITRE ATT&CK under its own terms.

ENISA's EU Vulnerability Database — the European Union's coordinated catalogue of vulnerabilities, established under the NIS2 directive.

Source: ENISA European Vulnerability Database. Re-use authorised with acknowledgement of the source.

Commission Implementing Regulation (EU) 2024/2690 — the technical and methodological requirements underpinning NIS2. Its Annex is the mappable control catalogue; the NIS2 Directive's own Article 21(2) is ten uncontrolled noun-phrases and is deliberately not modelled.

© European Union, eur-lex.europa.eu. Re-use authorised (Decision 2011/833/EU) with source acknowledgement and indication of any changes.

OffSec Exploit Database — a curated archive of public exploits and PoCs, mapped to the CVEs they exploit.

Exploit Database © OffSec Services Ltd. and contributors, GPL-2.0-or-later.

FIRST's Exploit Prediction Scoring System — daily-updated probabilities that a CVE will be exploited in the next 30 days, with a percentile rank.

MISP Galaxy (CC0-1.0 / BSD-2-Clause); clusters derived from MITRE ATT&CK carry ATT&CK's attribution independently.

MITRE ATT&CK — a knowledge base of real-world adversary tactics and techniques, used to describe how vulnerabilities are exploited.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK, CAPEC, CWE and D3FEND are trademarks of The MITRE Corporation.

MITRE Common Attack Pattern Enumeration and Classification — attack patterns bridging software weaknesses (CWE) to the ATT&CK techniques that realize them.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK, CAPEC, CWE and D3FEND are trademarks of The MITRE Corporation.

Center for Threat-Informed Defense mappings-explorer — the ATT&CK technique to NIST SP 800-53 control mappings. Apache-2.0.

© Center for Threat-Informed Defense. Licensed under Apache-2.0; incorporates MITRE ATT&CK under its own terms.

MITRE's Common Weakness Enumeration — a community catalogue of software and hardware weakness types (the CWE-… classes vulnerabilities are mapped to).

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK, CAPEC, CWE and D3FEND are trademarks of The MITRE Corporation.

MITRE D3FEND — a knowledge graph of defensive cybersecurity countermeasures and their mappings to the ATT&CK techniques they counter.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK, CAPEC, CWE and D3FEND are trademarks of The MITRE Corporation.

Rapid7 Metasploit Framework — exploit/auxiliary modules with a reliability rank, mapped to the CVEs they exploit.

Metasploit Framework © Rapid7 LLC and contributors, BSD-3-Clause. Rapid7's name may not be used to endorse derived products.

NIST Cybersecurity Framework 2.0 categories and the NIST 800-53 to CSF informative-reference crosswalk (OLIR/CPRT). US Government public domain.

Republished courtesy of NIST, U.S. Department of Commerce; not copyrighted in the United States.

The U.S. National Vulnerability Database — NIST's feed of analysed CVE records, with CVSS scores, CWE mappings and CPE product data.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Google's Open Source Vulnerabilities database — advisories aggregated across open-source ecosystems (npm, PyPI, Go, …), keyed to affected package versions.

Licensed per upstream record: e.g. GitHub Advisory Database entries are CC BY 4.0, RustSec is CC0 1.0. See google.github.io/osv.dev/data.

SigmaHQ Sigma rules — a generic, SIEM-agnostic signature format for detection rules, mapped to the ATT&CK techniques/groups/software and CVEs they detect.

Detection rules remain © their respective authors (retained per rule) under the Detection Rule License 1.1.