| 1 | Canonical vulnerability records
Link(s): github.com/CVEProject/cvelistV5, github.com/cisagov/vulnrichment, nvd.nist.gov, www.cve.org
Access / Cost: Free public / open-source; NVD optional API key | Relevance: CVE, NVD, CVE schema, & CISA Vulnrichment provide base vulnerability identity & enrichment.
Notes & POIs: Use as foundational sources but enrich with vendor/package-specific affectedness. |
| 2 | Package & ecosystem advisories
Link(s): github.com/advisories, github.com/github/advisory-database, osv.dev
Access / Cost: Free public / open-source | Relevance: OSV, GHSA, & language advisory DBs provide package-level affected version data.
Notes & POIs: Prefer PURL/package semantics over CPE for OSS dependencies. |
| 3 | Vendor & distro affectedness
Link(s): access.redhat.com/security/data, secdb.alpinelinux.org, security-tracker.debian.org, ubuntu.com/security/oval, www.suse.com/support/security/csaf
Access / Cost: Mostly free public; some vendor support entitlements may apply | Relevance: CSAF, VEX, OVAL, secdb, OSV, & vendor advisories identify whether a specific product/package is affected.
Notes & POIs: Essential for reducing false positives & handling backports. |
| 4 | Exploitability & prioritization
Link(s): github.com/rapid7/metasploit-framework, viz.greynoise.io, www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json, www.exploit-db.com, www.first.org/epss
Access / Cost: Mixed: free public, open-source, free tiers / paid plans | Relevance: KEV, EPSS, SSVC, CVSS, Exploit-DB, Metasploit, & GreyNoise inform urgency.
Notes & POIs: Do not conflate severity with exploitability. |
| 5 | Weakness & adversary mapping
Link(s): attack.mitre.org/matrices/enterprise, atlas.mitre.org, capec.mitre.org, cwe.mitre.org
Access / Cost: Free public | Relevance: CWE, CAPEC, ATT&CK, & ATLAS map vulnerabilities to weaknesses & adversary behavior.
Notes & POIs: Useful for detection engineering & root-cause analysis. |
| 6 | AI-specific vulnerability context
Link(s): atlas.mitre.org, owasp.org/www-project- machine-learning-security-top-10, owasp.org/www-project-top-10-for-large-language-model-applications, www.nist.gov/itl/ai-risk-management-framework
Access / Cost: Free public / open community | Relevance: ATLAS, OWASP LLM Top 10, OWASP ML Top 10, & NIST AI RMF frame AI/ML risk.
Notes & POIs: AI vulnerabilities often lack CVEs; include threat-model & control frameworks. |
| 7 | SBOM & identity
Link(s): cyclonedx.org/specification/overview, github.com/package-url/purl-spec, nvd.nist.gov/products/cpe, spdx.dev/specifications
Access / Cost: Free public / open standards | Relevance: CycloneDX, SPDX, PURL, CPE, & SWID identify components for matching.
Notes & POIs: Accurate inventory is prerequisite to vulnerability assessment. |
| 8 | Exposure telemetry
Link(s): leakix.net, search.censys.io, viz.greynoise.io, www.shadowserver.org, www.shodan.io
Access / Cost: Mixed: free public, free tiers, paid plans, registration-based access | Relevance: Censys, Shodan, Shadowserver, GreyNoise, LeakIX, & internal inventory help assess real exposure.
Notes & POIs: External scan data can be stale or incomplete; join with internal evidence. |
| 9 | Malicious package & supply-chain compromise
Link(s): github.com/advisories?query=type%3Amalware, github.com/ossf/malicious-packages, github.com/ossf/package-analysis, security.snyk.io, socket.dev/blog, sonatype.com/resources/vulnerability-database
Access / Cost: Mixed: free public, open-source, free tiers / commercial products | Relevance: Tracks malicious package risk that may not appear as conventional CVEs.
Notes & POIs: Essential for supply-chain defense & dependency risk. |
| 10 | Detection engineering
Link(s): codeql.github.com, github.com/projectdiscovery/nuclei, google.github.io/oss-fuzz, joern.io, samate.nist.gov/SARD, semgrep.dev
Access / Cost: Mixed: free/open-source, free public datasets, commercial tiers for some products | Relevance: CodeQL, Semgrep, Joern, Infer, Nuclei, OSS-Fuzz, SARD, & vulnerability datasets support detection & validation.
Notes & POIs: Detection quality depends on rule precision, context, & evidence quality. |
| 11 | Threat intelligence
Link(s): blog.google/threat-analysis-group, blog.talosintelligence.com, cloud.google.com/blog/topics/threat-intelligence, unit42.paloaltonetworks.com, www.microsoft.com/en-us/security/blog/topic/threat-intelligence, www.rapid7.com/blog/tag/vulnerability-management, www.ransomware.live
Access / Cost: Mostly free public blogs/research; commercial threat intel products separate | Relevance: Mandiant, Microsoft, Google TAG, Unit 42, Talos, Rapid7, ransomware & IOC feeds provide exploitation-in-the-wild context.
Notes & POIs: Research sources vary in timeliness, depth, & attribution confidence. |
| 12 | Compliance & configuration impact
Link(s): github.com/ComplianceAsCode/content, ncp.nist.gov, public.cyber.mil/stigs, www.cisecurity.org/cis-benchmarks, www.open-scap.org
Access / Cost: Mostly free public / open-source; CIS benchmarks may require free registration & commercial tools exist | Relevance: CIS, STIG, SCAP, cloud posture, & Kubernetes benchmarks help assess environmental control weakness.
Notes & POIs: These are not vulnerability feeds but determine practical risk & exploitability. |