Vulnerability-Lookup (https://vulnerability.circl.lu/) is an open-source platform run by CIRCL, the Luxembourg CERT. It aggregates vulnerability data from many sources (CVE, GitHub advisories, PySec, CSAF feeds and more). It also collects “sightings”: mentions, proofs of concept and exploitation reports seen on social media, in exploit databases, from honeypots and from the community. Every month we publish a report built from that data.

Highlights for October 2026:

• PHP2Shell (CVE-2026-109618 / CVE-2026-109619): two memory-safety flaws in the PHP interpreter leaked before their coordinated release on 21 October and drew 1,773 sightings. Exploitation was observed on disclosure day, five days before CISA listed them.
• 17,097 CVEs were published, a third record month in a row. Total sightings rose 20%, but proof-of-concept sightings fell 38% and exploitation sightings 20%.
• 200 vulnerabilities entered at least one of the five Known Exploited Vulnerabilities catalogs we track: CISA, CIRCL, ENISA / EU CSIRTs Network, The Shadowserver Foundation and Previdian. The catalogs are federated through GCVE (https://gcve.eu/), and the report includes a matrix showing which catalog covers what.
• Ivanti Connect Secure had three CISA entries. CIRCL confirmed the first one before its CVE record was published.
• Previdian covered all 36 CISA additions and flagged 19 of them earlier, in one case by 77 days.

Severity levels come from our open VLAI models (https://arxiv.org/abs/2507.03607). The report was generated with AI assistance using VulnMCP (https://github.com/vulnerability-lookup/VulnMCP). Feedback is welcome on GitHub (https://github.com/vulnerability-lookup/vulnerability-lookup/issues/).