BSI Germany, CERT-Bund WID

https://wid.cert-bund.de/content/public/securityAdvisory/rss

Federal Office for Information Security (Germany), CERT-Bund's WID advisory portal. The /portal/wid/kurzinformationen page is a JS-rendered SPA (WebFetch returns only the header). PRIMARY URL is the RSS feed. For per-advisory detail, fetch `https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-YYYY-NNNN`. **Never cite the kurzinformationen index**, always cite the per-advisory detail URL. 2026-05-08 audit: RSS returned 5 advisories all 2026-05-07 incl. LiteLLM, Checkmk, Linux Kernel. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → rss: python3 tools/fetch_source.py feed https://wid.cert-bund.de/content/public/securityAdvisory/rss 5 (then per-advisory body via api: python3 tools/fetch_source.py bsi-csaf WID-SEC-YYYY-NNNN). AVOID: Do NOT WebFetch the /portal/wid/kurzinformationen index; it is a JS-rendered SPA returning only the header. Never cite the index; cite the per-advisory securityadvisory?name=WID-SEC URL.. | 2026-07-05 admiralty audit: A (HIGH->A), German federal CERT, primary authority; keep active. Cite per-advisory securityadvisory?name=WID-SEC URL; body via bsi-csaf subcommand. | 2026-10-02 (2026-10-02T0404Z-intel): `fetch_source.py bsi-rss` prints RSS XML (not JSON), capped at 250 items with `[NEU] [kritisch]/[hoch]` markers in titles; a regex over <item> works, but the cap means the oldest hours of a 50 h window may be missing. | 2026-10-03 S2: the WID RSS (`bsi-rss`) carries only vulnerability advisories; BSI's other announcements are on https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/alle-meldungen-news_node.html: `url --direct <that URL>` returns a dated server-rendered listing, then `extract <item URL>`; `pdf <url>` reads the Hinweis PDFs. (2026-10-03T0404Z-intel) | 2026-10-09 (2026-10-09T0255Z-intel): S1: bsi-rss returned 250 items reaching back only to 2026-10-07 11:58 UTC because a bulk [UPDATE] refresh of about 150 older advisories filled the cap; the [NEU] filter still covered a 25 h window, a 48 h window would be truncated. | 2026-10-22 (S2): recipe: `fetch_source.py bsi-rss` prints raw RSS XML (250 items, newest first, [NEU]/[UPDATE] prefixes), not JSON; parse with a regex over <item> and filter on [NEU]; a 48 h window is truncated by the [UPDATE] refresh. | 2026-10-25 (2026-10-25T1308Z-audit): G1 re-sweep: the RSS reaches back only about two days; a lookback beyond that needs the WID listing. | 2026-10-26 (S2): `bsi-rss` returns raw RSS XML rather than JSON in this transport (250 items); parse `<item>` with a regular expression. | 2026-11-01 (2026-11-01T1312Z-audit): G1 recipe for a week's lookback: the bsi-rss feed reaches back about two days; `url --direct https://wid.cert-bund.de/.well-known/csaf/white/changes.csv` lists every CSAF id with its last-modified stamp, then `bsi-csaf WID-SEC-2026-<n>` per id.