# Vulnerability-Lookup 4.0.0 is out – Federation is here

**URL:** <https://discourse.ossbase.org/t/vulnerability-lookup-4-0-0-is-out-federation-is-here/1019>\
**Category:** Vulnerability-Lookup\
**Tags:** release, vulnerability-lookup\
**Created:** [February 16, 2026, 7:43pm UTC](https://discourse.ossbase.org/t/vulnerability-lookup-4-0-0-is-out-federation-is-here/1019 "2026-02-16T19:43:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cedric](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/cedric/32/112_2.png) [@cedric](https://discourse.ossbase.org/u/cedric)\
**Post date:** [February 16, 2026, 7:43pm UTC](https://discourse.ossbase.org/t/vulnerability-lookup-4-0-0-is-out-federation-is-here/1019/1 "2026-02-16T19:43:38Z")

</div>

We are pleased to announce the release of **Vulnerability-Lookup 4.0.0** — a second major milestone at the beginning of this year.

This version is paving the way for federated deployments of Vulnerability-Lookup instances.

## What’s New

### Remote Instance Synchronization

A local instance can now pull objects — including **bundles, comments, sightings, and KEV entries ([BCP-07](https://gcve.eu/2026/02/15/what-s-new-2026-02-15/))** — from configured remote Vulnerability-Lookup instances via their public APIs.

The synchronization engine includes:

- Remote instance management with per-object-type synchronization controls
- Timestamp-based update detection to keep data consistent
- Asynchronous scheduler with graceful shutdown support
- CLI command and systemd service template for automation
- Administrative controls to trigger synchronization manually
- Visual indicators in the interface to clearly identify synchronized objects

This enables controlled federation between trusted instances while maintaining operational visibility.

The documentation is available [here](https://www.vulnerability-lookup.org/documentation/sync.html).

**Remote instances configuration**

 ![remote_instances](https://discourse.ossbase.org/uploads/default/original/1X/3a5b3fe66958401cf65c39478fb0218ddd1a2620.jpeg)

**About page listing configured remote instances**

 ![about_page](https://discourse.ossbase.org/uploads/default/original/1X/fb20d9bd35142c624ecd4c4a76a35faa0f4f83ab.jpeg)

**Synced comments**

 ![sync_comments](https://discourse.ossbase.org/uploads/default/original/1X/c3b7aad87300f61f7a864a648159bf81cd19fdd0.jpeg)

**Synced KEV Catalogs**

 ![sync_kev](https://discourse.ossbase.org/uploads/default/original/1X/9bfbba1b5fb374bcf1f2f9ed5f9f96e8d41e9d89.jpeg)

### New Security Advisory Sources

Two new feeders expand Vulnerability-Lookup’s ingestion capabilities:

- **RustSec OSV feeder** [bf0c435](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/bf0c435)

- **OSS-Fuzz feeder** with support for YAML sources in OSV [21f2309](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/21f2309)

 ![sources](https://discourse.ossbase.org/uploads/default/original/1X/b6e8628dc2c8528472920ac3f535a02eda637b39.jpeg)

## Changes

- Improved global dashboard layout for better clarity and navigation [91db7fd](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/91db7fd)

- CSAF and OSV templates made fully generic [418b590](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/418b590)

## Fixes

- Timestamps are now consistently converted to UTC before JSON serialization, preventing timezone mislabeling when the database session runs in a non-UTC timezone [4f7149e](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/4f7149e)

- API updated to handle the new data format returned by Rulezet [5489d29](https://github.com/vulnerability-lookup/vulnerability-lookup/commit/5489d29)

## Changelog

For the complete list of changes, please refer to the GitHub release notes:  
[v4.0.0 Release Notes](https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v4.0.0)

## Feedback and Support

If you encounter any issues or have suggestions, please open a ticket on our GitHub repository:  
[GitHub Issues](https://github.com/vulnerability-lookup/vulnerability-lookup/issues)

## Follow Us on the Fediverse

Stay updated on security advisories and project news in real time by following us on Mastodon:  
[@vulnerability\_lookup](https://social.circl.lu/@vulnerability_lookup/)