- cvelistv5: inverse-unaffected fix bound now only for records with
exactly ONE unaffected entry. Firefox ESR CVEs carry two (e.g.
CVE-2026-16361: 115.38 lte 115.* + 140.13 lte *), and Mozilla writes
the ESR floor as an unbounded 'lte *', so a 'below X' rule wrongly
flagged regular Firefox 121/152. Multi-train records now skipped.
- advisory feeds: DEFAULT cisco-psirt URL corrected to
psirtrss20/CiscoSecurityAdvisory.xml (old rss.x?i=44 is DTD-refused);
saved configs auto-migrate the stale URL on load.
vulncheck
3bb480c39f