CIRCL Vulnerability-Lookup

CIRCL Vulnerability-Lookup

CIRCL's Vulnerability-Lookup is a keyless JSON API and web interface that aggregates vulnerability records across sources. The about page says: "Vulnerability-Lookup consolidates vulnerabilities from multiple sources." Records can carry aliases across identifier schemes such as CVE and GHSA, and a published policy endpoint at /.well-known/api-policy.json states usage limits and sync guidance.

Coverage

Sources listed on the about page include CVE Program (Creative Commons Attribution 4.0 International), NVD (Public Domain), GitHub (Creative Commons Attribution 4.0 International), PySec (Creative Commons Attribution 4.0 International), GSD (Creative Commons Zero v1.0 Universal) and CSAF vendor feeds, among others; the about page's own source and record counts change continuously, so exact totals are Not stated here. History start and update frequency: Not stated.

Verdict

A keyless JSON API for defensive vulnerability lookups, aliasing records across identifier schemes such as CVE and GHSA. The policy endpoint sets anonymous requests at "20 per minute" and authenticated requests at "40 per minute", keyed by API key or IP address, and asks automated clients to identify themselves with "a meaningful User-Agent string that includes a contact URL or email." Attribution follows each upstream source's own licence as listed on the about page; sources differ (for example NVD is Public Domain while CVE Program and GitHub are CC BY 4.0). The policy says: "Do not enumerate the API to mirror the dataset." Defensive vulnerability metadata only. This is a different CIRCL service from the hashlookup and BGP Ranking APIs already in the catalog. Signal Lab links only.