Loading story…
The Global CVE initiative has published GCVE BCP-12, a proposed standard for recording and exchanging vulnerability sightings across vulnerability-management platforms, security tools, feeds, and analysis systems. The specification is based on the sighting model already used in Vulnerability-Lookup and is designed to capture time-bound assertions from specific observers rather than treating each report as a universal fact, allowing multiple organizations to share complementary or conflicting observations about mentions, analyst validation, proof-of-concept release, exploitation, and patching outcomes.
The release comes as vulnerability-tracking data shows rising pressure on defenders and growing demand for better interoperability. DKCERT, citing Vulnerability-Lookup's June 2026 report, said 7,454 CVEs were published in June and more than 27,000 sightings were aggregated, including over 8,500 directly tied to exploitation; nine of the ten most observed vulnerabilities also appeared in CISA's Known Exploited Vulnerabilities catalog. The report highlighted active attacker interest in remote access, network appliances, and identity services, with heavily watched flaws affecting Oracle PeopleSoft, Cisco, Ivanti Sentry, SimpleHelp, Check Point Security Gateway, BeyondTrust Remote Support/PRA, and even older issues such as the 2017 HP iLO 4 authentication bypass, underscoring why a common sighting format is being advanced for public review.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
GCVE published BCP-12, a standard format for recording and exchanging vulnerability sightings, based on the format already implemented in Vulnerability-Lookup. The specification was released for public review and feedback and is intended to improve interoperability across vulnerability-management platforms and security tools.
Vulnerability-Lookup's June 2026 report included the Shadowserver Foundation for the first time as a honeypot data provider. The added data improved visibility into real-world attacker behavior and showed ongoing attacks against older flaws such as a 2017 HP iLO 4 authentication bypass.
In June 2026, Vulnerability-Lookup recorded 7,454 published CVEs, more than 27,000 sightings across associated data sources, and over 8,500 sightings directly tied to exploitation. The data indicated rapid transition from disclosure to attack activity and heavy focus on remote access, appliances, and identity services.
GCVE released Vulnerability-Lookup 5.0.0 with a CNA-interoperable API for reserving identifiers and ranges, editing and publishing records, and synchronizing data. The release also added deeper Vulnogram integration and support for both CVE JSON 5.2 and the GCVE vulnerability format.
GCVE said the sighting format implemented in Vulnerability-Lookup had already been used operationally over the past months, providing practical experience that informed later standardization work.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
gcve.eu
Open sourcegcve.eu
Open sourcecert.dk
Open sourcevulnerability-lookup.org
Open sourcemisp-standard.org
Open sourcedb.gcve.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new EU-focused vulnerability database, `db.gcve.eu`, has gone live under the **GCVE (Global Cybersecurity Vulnerability Enumeration)** initiative, providing a free, publicly accessible repository intended to support vulnerability management and improve European digital sovereignty. The service aggregates and normalizes vulnerability information from numerous public sources, aiming to reduce reliance on US-centric vulnerability databases. The platform is built around the **GNA (GCVE Numbering Authority)** model, which is positioned as a decentralized alternative to traditional centralized assignment of vulnerability identifiers (e.g., CVE IDs). It is designed to allow autonomous assignment and publication of vulnerability identifiers without waiting for central approval, and it reportedly integrates data from **25+** different sources to make vulnerability records structured, searchable, and easier to operationalize for security teams.
Jun 29, 2026
Security teams are increasingly de-emphasizing *CVSS-only* approaches in favor of prioritizing **known exploited vulnerabilities (KEV)**, driven by evidence that only a small fraction of disclosed CVEs are exploited in the wild. Reporting citing VulnCheck research highlighted that roughly **1% of 40,000+** vulnerabilities disclosed in the prior year saw in-the-wild exploitation, with **network edge devices** disproportionately targeted (reported as **28%** of KEV-impacted products) and recurring exposure across major enterprise stacks including **Microsoft, VMware, Oracle, Ivanti, SonicWall, and Fortinet**. The same research pointed to high-profile exploitation waves such as **SharePoint zero-days** impacting **400+ organizations** and rapid weaponization dynamics like **React2Shell**, which reportedly accumulated **236 public exploits** within a month. In the UK public sector, the Department for Science, Innovation and Technology (DSIT) reported operational improvements from a centralized **Vulnerability Monitoring Service** that continuously scans internet-facing systems across roughly **6,000 organizations** and drives remediation of about **400 confirmed vulnerabilities per month**. DSIT said median remediation time for critical domain-related weaknesses fell to **eight days** (from ~50), other vulnerabilities to **32 days** (from 53), and the backlog of unresolved critical flaws dropped by about **three-quarters**—positioning automated discovery and faster patch cycles as a practical response to long-standing government security shortfalls, even as officials did not quantify exploitation rates or overall compromise trends.
Jun 29, 2026
The CVE Program approved updated **CVE Numbering Authority (CNA) Rules** that broaden how vulnerabilities can be assigned identifiers and clarify which CNA should handle a report. The revised framework introduces a **right-of-first-refusal** model that favors the CNA with the most appropriate scope, adopts more **technology-neutral** criteria for deciding whether an issue merits a `CVE`, and adds clearer guidance on what types of findings do and do not qualify for assignment. The changes are expected to affect vulnerability management by increasing flexibility for CNAs and potentially expanding coverage to issues that previously sat in gray areas, including some **cloud misconfigurations** and certain **supply-chain compromises**. The updated guidance still leaves open questions around shared code, protocols, specifications, and upstream dependencies, with examples such as **HTTP/2 CONTINUATION Flood** and **HTTP/2 Rapid Reset** illustrating the continuing ambiguity over how broadly CVEs should be assigned.
Jul 24, 2026