About the platform

    NEOSEC Intel

    A German-language platform for vulnerability and threat intelligence, built by NEOSEC GmbH for mid-sized companies and KRITIS operators under NIS2.

    What NEOSEC Intel does

    We consolidate publicly available security data sources – NVD, CVE.org, CISA, BSI, GHSA, OSV, MSRC, abuse.ch, vendor PSIRTs – into one German-language situational picture. Instead of reading five sources side by side, security teams see at a glance what's new, what's critical, what affects their own stack and what is actively exploited (CISA KEV). We address operators under NIS2 and manufacturers under the Cyber Resilience Act (EU 2024/2847). For manufacturers this means from December 2027: Coordinated Vulnerability Disclosure, SBOMs and security updates across the entire lifecycle.

    Sources & licenses

    Every source NEOSEC Intel uses, grouped by purpose – with origin, license and a note on how we use it. BSI content is never mirrored 1:1; commercial tech news appears strictly as an RSS teaser with a link to the original.

    Map of all sources by location

    Vulnerability advisories (structured)

    Vulnerability advisories (structured)
    SourceLicenseNote
    NIST NVDUS Government Open Data (effectively CC0)–
    CVE.org / MITRE CVE ServicesCVE Record Format – CC0 1.0–
    CISA Known Exploited Vulnerabilities (KEV)US Government Open Data – Public Domain–
    BSI CERT-Bund WID (RSS + CSAF 2.0)BSI EigenurheberrechtLink and our own enrichment only, no 1:1 mirroring.
    GitHub Security Advisories (GHSA)CC-BY-4.0–
    OSV.dev (Open Source Vulnerabilities)Pro Ökosystem unterschiedlich – überwiegend CC-BY-4.0 / CC0 1.0 / Apache-2.0 / MITWe take all 44 ecosystems: PyPI, npm, Go, crates.io, Maven, RubyGems, NuGet, Packagist, Hex, Pub, Debian, Ubuntu, Red Hat, AlmaLinux, Rocky Linux, SUSE, Alpine, Echo and more.
    Microsoft Security Response Center (MSRC) CVRFMicrosoft Permitted Use – Public Vendor ContentLinked to the official Update Guide entry only.
    ENISA EUVD (European Vulnerability Database)EU Public Sector Information – free reuse with attributionThe EU counterpart to the NVD since May 2025. JSON API with CVSS v3/v4, EPSS and aliases to CVE IDs.
    Debian Security Advisories (DSA)Debian Security Tracker – freie Daten des Debian-ProjektsMetadata and a link to the advisory only.
    Debian LTS Advisories (DLA)Debian Security Tracker – freie Daten des Debian-ProjektsAdvisories for Debian releases in long-term support (currently bookworm). Metadata and a link to the advisory only.
    Ubuntu Security Notices (USN)CC-BY-SA-4.0 (Share-Alike)Metadata and backlink only, no full text.
    pwn.watchNutzung mit Erlaubnis des Betreibers – keine veröffentlichte LizenzOperator: Kristijan Ristovski (Kitze), Gdynia, Poland. Incidents with patch status and fixed versions; attacks and data breaches as news. Attribution with a link for every entry.
    NCSC UK alerts (news)OGL v3.0Vulnerability alerts only (CVE or alert title), full text under OGL v3.0. Evidence only for confirmed exploitation.

    Asia-Pacific

    Asia-Pacific
    SourceLicenseNote
    ASD ACSC Alerts & AdvisoriesCC BY 4.0Full text permitted (CC BY 4.0). Evidence only for alerts with confirmed exploitation.
    NCSC NZ AdvisoriesCC BY 4.0Full text permitted (CC BY 4.0). Evidence only for alerts with confirmed exploitation.
    JPCERT/CC alerts (注意喚起)© JPCERT/CC – keine offene LizenzTitle, date, link and CVE numbers only. Evidence only when confirmed exploitation is noted.
    HKCERT Security BulletinsCC BY 3.0 HKFull text under CC BY 3.0 HK with the HKCERT risk rating as a second opinion; evidence only for confirmed exploitation.
    SingCERT Alerts & AdvisoriesSchriftliche Erlaubnis CSA/SingCERTWith written permission from CSA; full text and German machine translation. Evidence only for alerts with confirmed exploitation.

    Threat intel and indicators of compromise

    Threat intel and indicators of compromise
    SourceLicenseNote
    NCSC UK Malware Analysis ReportsOGL v3.0Hashes, IPs, domains and URLs from the reports' indicator and STIX files (OGL v3.0). Paths, registry values and YARA stay in the report.
    abuse.ch URLhausCC0 1.0 Public Domain–
    abuse.ch MalwareBazaarCC0 1.0 Public Domain–
    abuse.ch ThreatFoxCC0 1.0 Public Domain–
    abuse.ch Feodo TrackerCC0 1.0 Public Domain–
    AlienVault OTX (subscribed pulses)Pro Pulse unterschiedlich – wir filtern strikt auf TLP:WHITETLP:WHITE only.
    Tor Exit Node List (onionoo.torproject.org)Public – BSD-style–

    Exploitation evidence

    Exploitation evidence
    SourceLicenseNote
    CIRCL Vulnerability-Lookup – KEV catalogue and sightingsCC0 1.0Only CIRCL's own KEV catalogue and CIRCL sightings (exploitation, proof of concept). The CISA, ENISA, Shadowserver and Previdian catalogues are not taken over.
    CERT.at warnings© CERT.at GmbH – keine Lizenz veröffentlichtlinked-only – title, date, link and CVE numbers, no text. Evidence only when marked "aktiv ausgenutzt" (actively exploited).
    ANSSI / CERT-FR AlertesLicence Ouverte / Open Licence 2.0 (etalab-2.0)Per evidence item: ANSSI / CERT-FR, Licence Ouverte 2.0, date of the alerte.
    Apple note in CVE recordswie CVE.org (Direktquelle)Only Apple's description in the CVE record ("may have been exploited") is evaluated; nothing is fetched from apple.com.

    Enrichment

    Enrichment
    SourceLicenseNote
    CrowdSec CTI (community signal)Free Tier mit AccountFlagging only, no re-export.
    VirusTotal v3 (Free Public API)Free-Tier ToS – keine Bulk-RedistributionDetection ratio, reputation and permalink only.
    EPSS (FIRST.org Exploit Prediction Scoring System)CC0 1.0 Public Domain–
    IP Geolocation by DB-IP (IP to Country Lite)CC BY 4.0Country lookup only: IOC statistics and abuse protection for sign-in and forms.
    CISA Cybersecurity Advisories RSSUS Government Open DataMetadata and backlink only.

    News & editorial RSS

    News & editorial RSS
    SourceLicenseNote
    Cisco PSIRTVendor Permitted Use – linked-only–
    Fortinet PSIRTVendor Permitted Use – linked-only–
    VMware (Broadcom) Security BlogVendor Permitted Use – linked-only–
    NCSC-NL Security AdvisoriesNational CERT (Niederlande) – Public Domain–
    ANSSI / CERT-FRLicence Ouverte / Open Licence 2.0 (etalab-2.0)Avis, Actualités and CTI. Alertes run through a separate ingest as exploitation evidence.
    MITRE ATT&CK Release BlogMITRE ATT&CK Framework – Apache 2.0 (Daten) / Medium (Blog)–
    SANS Internet Storm Center DiaryTLP:WHITE Community Content–
    Krebs on SecurityEditorial © Brian Krebs – RSS Teaser + Backlink–
    The Hacker NewsEditorial – RSS Teaser + Backlink–
    BleepingComputerEditorial – RSS Teaser + Backlink–
    DarkReadingEditorial – RSS Teaser + Backlink–
    Schneier on SecurityCC-BY-NC-SA – RSS Teaser + Backlink–
    Heise SecurityEditorial – RSS Teaser + Backlink–
    Golem SecurityEditorial – RSS Teaser + Backlink–
    ZDNet SecurityEditorial – RSS Teaser + Backlink–
    CSO Online (Foundry)Editorial – RSS Teaser + Backlink–
    The Register (Security)Editorial – Atom Teaser + Backlink–
    Ars Technica SecurityEditorial – RSS Teaser + Backlink–
    SecurityWeekEditorial – RSS Teaser + Backlink–
    SANS NewsBites (mail subscription)TLP:WHITENo public RSS feed; received via the mailing list.
    BSI Alliance for Cyber Security (ACS) — RSS feedBSI Eigenurheberrecht – linked-onlyIncluding cyber security warnings, only with a backlink to the original. Partner offers are not taken over.

    Enrichment

    English-language advisories are translated into German with a curated glossary – including sector relevance (which industries are affected?) and NIS2 / ISO 27001 context. Translation and enrichment run, fully logged, through our own interface to language models; data of signed-in users never enters AI processing.

    Prioritisation

    Every vulnerability gets a priority on a scale from 0 to 325, combining CISA KEV status, ransomware use, EPSS probability, CVSS severity, recency and the prevalence of the affected products in Germany. That's how over 3.1 million entries collapse into two screens of what actually warrants attention this week. This is distinct from the XIEM® Effective CVSS on CVE pages: the highest available CVSS score from NVD and vendor data (0 to 10).

    Methodology: formula, scale and rules

    Operator

    Operated by NEOSEC GmbH, Mönchengladbach. Managing Director: J. Benjamin Espagné. This platform is part of the NEOSEC product family: Radar®, Sonar®, XIEM® Sentry/Orchestrate/Command and XIEM® Central. Anonymous research is freely available; in-depth analysis, alerting and matching against your own inventory are part of our customer offering.

    Public Beta

    The platform is in public beta. Which features are live, in beta or planned is listed in the plans overview. Feedback to support@neosec.eu – we read every email.

    View plans and status

    Interfaces

    RSS feed
    intel.neosec.eu/feed.xml
    JSON API
    api.intel.neosec.eu – access with an API token from your account
    Webhooks
    Notifications for new entries, set up in your account
    MISP export
    Delivery to your MISP instance, set up in your account

    API documentationPlans and status