Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization

A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.

HabrAugust 22, 2026Translated from Russian

Read at source

A Russian security engineer has released Vulnaware, an open-source prioritization engine designed to solve one of the most persistent problems in vulnerability management: ensuring that genuinely dangerous flaws reach remediation teams before they become incidents.

The project was created after the author observed that vulnerabilities rarely compete successfully for attention inside IT service desks because they lack an associated ticket, SLA, or downtime impact. According to Verizon DBIR 2026, exploitation of vulnerabilities overtook credential theft for the first time in the report’s 19-year history, accounting for 31 percent of breaches compared with 20 percent the previous year.

Vulnaware is not a vulnerability scanner or a full VM platform. Instead, it functions as an independent layer that sits between existing scanners and ITSM systems. It currently accepts data from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS. Scope is limited at ingestion using asset groups, scan folders, or host tags so that only relevant assets are processed.

Prioritization relies on three concrete signals: presence in the CISA KEV catalog, availability of exploits in community feeds from Vulncheck, and trend indicators when available from MaxPatrol. The goal is to surface only those vulnerabilities that have at least one working exploit, dramatically reducing noise for security and IT teams.

Once an issue is prioritized, Vulnaware can automatically create tickets in Jira Service Management, GLPI, Znuny, and osTicket. It also sends notifications through a Telegram bot (with optional asset obfuscation) and email templates built with Jinja. A lightweight web interface allows manual review and one-click dispatch when automatic routing is not desired.

The tool’s design follows the five-stage lifecycle described in NIST SP 800-40 Rev. 4 and the risk-based timelines introduced by CISA BOD 26-04, which replaced rigid deadlines with a matrix considering asset exposure, KEV listing, exploit automation, and technical impact. By converting prioritized vulnerabilities into properly classified service requests or changes, the solution gives organizations measurable MTTR data for the flaws that actually matter.

CISA KEV Verizon DBIR NIST SP 800-40 MaxPatrol VM Nessus Pro Vulnaware Vulncheck

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese