ANSSI / CERT-FR

https://www.cert.ssi.gouv.fr/

French national cybersecurity agency. WebFetch on the root works; for machine-readable lists prefer the RSS feeds at https://www.cert.ssi.gouv.fr/avis/feed/ (advisories) and https://www.cert.ssi.gouv.fr/alerte/feed/ (active-exploitation alerts). Drill into per-advisory pages /avis/{id}/ to extract CVE lists and affected versions (CVSS scores generally absent in CERT-FR text). 2026-05-08 audit: WebFetch returned CERTFR-2026-AVI-0552 Ivanti EPMM 2026-05-07. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → api: python3 tools/fetch_source.py cert-fr avis-recent 5 (advisories) and cert-fr actu-recent 5 (alerts); then bridge `url https://www.cert.ssi.gouv.fr/avis/{id}/` per-advisory for CVE list + affected versions. WebFetch on the root also works.. AVOID: Don't expect CVSS scores in CERT-FR text; they cite CVE IDs and affected versions only. No need to WebFetch the root when the avis/alerte feeds are cleaner.. | 2026-06-30: CERT-FR actu feed returned only entries up to 2026-06-19 (S2 reports feed appears stale since Nov 2025 via bridge actu-recent). No in-window items; quiet-period++. National CERT, not demoted (transport 200, content stale); flag feed-staleness for investigation. | 2026-07-05 admiralty audit: A (HIGH->A), French national CERT, primary authority; keep active. NB: actualite (actu) feed still stale (last item Nov 2025) as flagged 2026-06-30; avis feed is fresh; flag actu-feed staleness for investigation, not a demotion. [2026-07-09] S2 observed fetch_source.py feed on CERT-FR actualite/avis feeds returns items ascending (oldest-first); N=20 surfaced Nov-2025 entries not the latest bulletin. Recheck raw feed order / consider reverse when assessing CERT-FR freshness. | 2026-07-11: KNOWN LIMIT, CERT-FR RSS feed renders a flat 00:00:00 +0000 timestamp for every item regardless of true publish time; for a "yesterday-dated" CERT-FR item the 24h recency floor is ambiguous, so corroborate the true publish time from the avis/actu page before dropping or including. | 2026-10-13 (S4): `cert-fr avis-recent` does not cover CERT-FR ALERT bulletins (ALE series); sweep https://www.cert.ssi.gouv.fr/alerte/feed/ each run too. The ALE-012 alert on Danfoss AK-SM/AK-SC refrigeration controllers (2026-10-12) was found there. | 2026-10-14 intel run: a CERT-FR alert can be revised after publication (CERTFR-2026-ALE-012 gained Copeland xweb and Dixell xweb on 2026-10-13 and its guidance was rewritten): re-read the page, not only the feed item date, and re-check cited quotes against the live text. | 2026-10-18 (S2): the CERT-FR version table ('Gestion détaillée du document') shows revision dates and descriptions only in the raw page (`url --direct <alert URL>`); the feed and `extract` hide revisions, so re-read each covered ALE page that way. | 2026-10-21 (2026-10-21T0256Z-intel, S1): `feed https://www.cert.ssi.gouv.fr/alerte/feed/ 8` lists the ALE alerts and `url --direct` of an ALE page shows its revision table, useful for the revised-advisory sweep. | 2026-10-22 (S2): recipe: `fetch_source.py feed https://www.cert.ssi.gouv.fr/cti/feed/ 8` lists the CERT-FR CTI reports (surfaced CERTFR-2026-CTI-008). | 2026-10-27 (S2): item links from the CERT-FR recipes now resolve under www.cert.cyber.gouv.fr; `feed https://www.cert.ssi.gouv.fr/alerte/feed/ 8` lists the CERTFR-2026-ALE alerts, `feed https://www.cert.ssi.gouv.fr/cti/feed/ 8` the CTI items, and `extract` of an ACT bulletin page returns its CVE/CVSS/PoC table.