- Five maritime and security organizations launched Blue Initiative, a free database. Its site says it indexes 29,523 entries, and 37 are labelled as built for ships and ports.
- SecurityWeek reports that most entries are pulled in automatically and mapped to maritime systems. The sources do not explain how the mapping works or how accurate it is.
- Leaders should ask whether they can match any such filter to a real inventory of vessel and port systems, and who owns the patching.
Security teams rarely lack information about software flaws. They lack a way to decide which flaws are theirs. A new database for the maritime industry is built around that gap.
What launched
Blue Initiative is a public database of software flaws for shipping. SecurityWeek reports that it comes from five groups. They are the security firm Cydome, the Japanese classification society ClassNK, the testing company Bureau Veritas, the shipping threat-sharing group MTS-ISAC, and Rakuten Maritime.
The site is free, and the community can contribute. Cydome researchers and partners review the listed entries. Users can browse, search and filter. They can also subscribe to alerts. According to the site, alerts cover new entries rated critical or high severity. They also cover anything added to CISA's Known Exploited Vulnerabilities (KEV) catalogue.
What the numbers show
The site says it has indexed 29,523 entries. Only 37 carry the label "maritime-native", meaning built for ships and ports. By WebPulse's arithmetic, that is roughly one entry in 800.
The site says the rest are general flaws that matter at sea. Most are pulled in automatically, and the sources do not explain the mapping. The site's pitch is that patching is hard to prioritise when hundreds of thousands of flaws are public. So it lists "only the ones that matter at sea". That is the site's claim. The sources give no test of it.
One entry the site shows is titled "Use of Hard-coded Cryptographic Key in Wärtsilä FOS-Onboard" (CVE-2026-78225). In general, hard-coded means a key is fixed in the software rather than set per installation. The listing gives no further detail. The sources do not say whether this entry carries the maritime-native label.
The IT side of the list
The site also shows entries with the top score of 10.0. Among them are Microsoft's Azure Kubernetes Configuration Service, Apache Traffic Server, Cisco License On-Prem and SonicWall's SMA1000. These are ordinary IT products.
The sources do not say how these products relate to any vessel. They do not say the products run on ships.
Here is the article's own argument, drawn from general industry knowledge. A ship runs office systems and networks as well as ship-specific equipment. Flaws in ordinary IT can matter there too. The sources do not confirm that for these entries.
How a flaw becomes a maritime entry
A CVE is a public ID number for one software flaw. A CVSS score rates how severe that flaw is, from 0 to 10. The score describes the flaw. It does not say who is exposed.
CISA's KEV catalogue is different. It lists flaws known to be used in real attacks. That is a statement about use, not severity.
SecurityWeek reports that most entries come from two CISA feeds: its industrial control system advisories and the KEV catalogue. They are then mapped to maritime systems. A smaller number carry hand-written analyst notes.
Operational technology (OT) is the equipment that moves and steers physical things. IT is the office and network layer. As general industry context, not from the sources, the two are often prioritised differently. An OT update may need a ship to be in port, while an IT update may be routine.
The value of this database sits in the mapping step. The sources do not say how it is done or how accurate it is.
Why severity alone may not sort the queue
The site gives its own count for the last 90 days. It lists 5,180 scored entries: 534 rated critical, 2,976 high, 1,568 medium, 101 low and one unscored. Critical and high together come to 3,510, about two-thirds.
The sources give no baseline for what a normal share would be. A 90-day slice may not be typical. It is the article's argument that when so many entries score high, the label does less to rank them.
Separately, SecurityWeek gives all-time figures. It says the database holds more than 2,000 entries with a critical CVSS rating. It also counts more than 580 vulnerabilities as known to be exploited in attacks. These are all-time totals, a different scope from the 90-day count.
Cydome CEO Nir Ayalon told SecurityWeek the goal is "a public and open single source of truth" for maritime flaws. He said IT and cyber teams should get a more focused view of risks for their own vessels.
What to ask your team
This is one launch. The sources do not test its accuracy independently. Treat it as a new input, not a verdict.
First, can we list what runs on each vessel and in each port system, including ordinary IT? A relevance filter only helps if there is an inventory to match it against.
Second, who owns patching for operational technology? Who decides when a ship can take an update?
Third, which flaws on this list appear in the KEV catalogue? That smaller, exploitation-based set is a sensible place to start.
Fourth, do our suppliers tell us when their products appear in a database like this?
Finding flaws is easy. Knowing which ones belong to your ship is the hard part, and that is the part this project claims to solve.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Blue Initiative (Cydome, ClassNK, Bureau Veritas, MTS-ISAC, Rakuten Maritime).
