# Vulnerability-Lookup 4.6.0

**URL:** <https://discourse.ossbase.org/t/vulnerability-lookup-4-6-0/1091>\
**Category:** Vulnerability-Lookup\
**Tags:** release, vulnerability-lookup\
**Created:** [May 21, 2026, 11:37am UTC](https://discourse.ossbase.org/t/vulnerability-lookup-4-6-0/1091 "2026-05-21T11:37:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cedric](https://discourse.ossbase.org/user_avatar/discourse.ossbase.org/cedric/32/112_2.png) [@cedric](https://discourse.ossbase.org/u/cedric)\
**Post date:** [May 21, 2026, 11:37am UTC](https://discourse.ossbase.org/t/vulnerability-lookup-4-6-0/1091/1 "2026-05-21T11:37:37Z")

</div>

We are excited to announce the release of **Vulnerability-Lookup 4.6.0**!  
This version brings more transparency, new data sources, API improvements, notable UI enhancements, and several performance and stability fixes.

## What’s New

### VLAI model transparency

The [VLAI](https://arxiv.org/abs/2507.03607) badge popover now surfaces the exact model name and revision used for a given analysis, with direct links to the HuggingFace model card and the revision commit. This is particularly useful as we regularly update our AI models and publish new versions on [HuggingFace](https://huggingface.co/CIRCL), making it easy to track exactly which model version produced a given result.

 ![VLAIversion1](https://discourse.ossbase.org/uploads/default/original/1X/9b5fa37b113c785ece89cb3896213118fac5bfc3.jpeg)

 ![VLAIversion2](https://discourse.ossbase.org/uploads/default/original/1X/4cf2004427fb6b05e71c594118bdb5a83b534be1.jpeg)

### Moksha feeder

A new feeder for [Moksha](https://moksha.circl.lu/) has been added, mirroring the indexing pattern used by the cvelistv5 source. Because Moksha is accessible over Tor, the feeder requires a local Tor instance and is disabled by default.

 ![Moksha](https://discourse.ossbase.org/uploads/default/original/1X/f7cd3fe82b2e7e2d79c3c7a254272824f31fc60b.jpeg)

### KEV catalog on the homepage and search results

The latest entries from CISA’s Known Exploited Vulnerabilities (KEV) catalog are now displayed directly on the homepage. KEV catalog badges also appear on the search results page, giving you an immediate signal when a vulnerability is actively exploited in the wild.

 ![Homepage](https://discourse.ossbase.org/uploads/default/original/1X/2f9b93578046192440643ee2439b8cf4db699087.jpeg)

### Improved CSAF advisory display

CSAF advisories now show a structured per-status product table derived from the `product_tree`, and the `/recent` page loads only the selected source with its own pagination — making it faster to browse recent activity.

 ![CSAF](https://discourse.ossbase.org/uploads/default/original/1X/7343cec87ea4b8b79913a2d15cc1749460d8fee0.jpeg)

### API additions

- A new `with_meta` parameter on the vulnerabilities list endpoint lets consumers fetch enriched metadata in a single call.
- Optional, tier-aware rate limits can now be applied to vulnerability read endpoints.
- A machine-readable access policy endpoint is available for automated consumers.

 ![APIpolicy](https://discourse.ossbase.org/uploads/default/original/1X/d3f1541a453e2aec90e023f1a88e519dd1652513.jpeg)

## Changes

- **Performance improvements** — Hot read endpoints are now cached with a Redis backend, full-text index writes are batched, and homepage sighting statistics are computed via a dedicated aggregated endpoint. These changes significantly reduce load under traffic spikes.
- **Homepage and template updates** — The home page displays more information at a glance; the sources list on the About page is now in a collapsible accordion; Moksha is available in the `/recent` source menu.
- **ML-Gateway** — The gateway response now includes the model name and revision, which are forwarded by the API ([project page](https://github.com/vulnerability-lookup/ML-Gateway)).
- **Dependencies** — Python dependencies have been updated.

## Fixes

This release includes a number of stability and correctness fixes: rate-limiter accuracy improvements (correct client IP resolution, dedicated Redis backend), Flask-Caching Redis pool reliability under gunicorn/gevent, EPSS badges on search results, timezone-aware timestamps for comments and bundles, restricted comment editing to authorized users only, and several minor UI and template corrections.

## Changelog

📂 For the full list of changes, check the GitHub release:

> **[Release Release 4.6.0 · vulnerability-lookup/vulnerability-lookup](https://github.com/vulnerability-lookup/vulnerability-lookup/releases/tag/v4.6.0)**
>
> What's New
> 
> new: \[feeders\] Added a Moksha feeder, with index population (index:moksha:published and index:published sorted sets) mirroring the cvelistv5 pattern. Disabled by default since it requir...

🙏 A big thank you to all contributors and testers!

## Feedback and Support

If you find any issues or have suggestions, please open a ticket on our GitHub repository:

> **[Issues · vulnerability-lookup/vulnerability-lookup](https://github.com/vulnerability-lookup/vulnerability-lookup/issues/)**
>
> Vulnerability-Lookup facilitates quick correlation of vulnerabilities from various sources, independent of vulnerability IDs, and streamlines the management of Coordinated Vulnerability Disclosure ...

We appreciate your feedback!

## Follow Us on Fediverse/Mastodon

Stay updated on security advisories in real-time by following us on Mastodon:

> **[Vulnerability-Lookup (@vulnerability\_lookup@social.circl.lu)](https://social.circl.lu/@vulnerability_lookup/)**
>
> 46K Posts, 14 Following, 113 Followers · This account shares a variety of activities, including comments and bundles, related to events on the vulnerability.circl.lu community.