The CSAF community is helping IT#Security to automate the exchange of vulnerability information: Faster and more precise.
Find and track the security of important software and hardware products you use, just by domain.
Publish advisories for your product as CSAF Provider.
This is an unofficial fediverse account for CSAF (https://www.csaf.io)
We send news on new developments, tooling, conferences and other stuff that's happening.
Did you know? https://github.com/gcve-eu/gcve-lab-patch2vuln
experimentally tries to turn a code patch into a CVE record and optionally
into a #CSAF document. Will be interesting to see if it helps humans
to get better reports faster with similar accuracy.
Operates with a local LLM.
RE: https://infosec.exchange/@ministraitor/117490258027910154
@intevation 's Sebastian Wagner at https://2026.hack.lu/agenda/#session/QQAPDW/ about how hard it is to match asset data with CSAF "product" versions.
(A problem that was discussed already last year at the CSAF Community Days 2025.)
The Struggles To Make CSAF Actionable - Sebastian Wagner #HackLu #LightningTalk @hack_lu https://youtu.be/BUwJ1ar6V58
Infosec ExchangeCooper (@[email protected])The Struggles To Make CSAF Actionable - Sebastian Wagner #HackLu #LightningTalk @hack_lu https://youtu.be/BUwJ1ar6V58CSAF 2.1 Draft 4 is here.
The committee has been busy and resolved all comments. :thinking_ie:
Thus "CSD04" has a many clarifications, more examples and editorial fixes.
CSAF 2.1 is a major upgrade over 2.0 and
aims to make automation of security advisories, status and impact
more practical.
Give feedback until the 6th November 2026.
(Go to https://docs.oasis-open.org/csaf/csaf/v2.1/csd04/csaf-v2.1-csd04.html or reload your browsers on the general URL.)