{
  "summary": "Vulnerabilities that are actually being exploited now weigh more than their CVSS score: CVEs on the CISA KEV or ENISA EUVD known-exploited lists open their risk with critical likelihood, are always notified (marked as known exploited in email, Slack and Teams, with EPSS shown from 10%), and escalate existing open risks once when a CVE becomes known-exploited; the CSAF card lists them first and the Risk Register gains Known exploited and EPSS badges and a filter. A new concentration view shows which providers the organisation's systems depend on - hosting, CDN, DNS, mail and sub-processors, each mapped to the company behind it - and opens an organisation-wide risk when at least three critical systems, and at least half of them, rely on the same provider; the dashboard gets a Concentration card and each system a Depends on card. A new Sustainability page estimates the climate footprint behind vendors and systems: vendor climate maturity from green-hosting checks and the vendor's own sustainability reporting (emissions, targets, SBTi, CSRD), usage emissions from SWG transfer volumes using the Sustainable Web Design Model, and spend-based scope 3 emissions from contract values extracted from uploaded contracts and converted to EUR, with admin overrides throughout and CSV export. Financial entities can keep a DORA register of information with the 15 EBA templates, prefilled from vendors, contracts and systems, validated against the EBA taxonomy rules and exported as xBRL-CSV. Settings now has a Features section for opt-in features, all off by default: the DORA register and the sovereignty assessment. Existing installations: the sovereignty assessment is off after the upgrade until an admin turns it on; entered SEAL data is kept. A system with several uploaded contracts now keeps the analysis of every contract instead of only the last one, which also stops the local AI from re-analysing the same contracts on every run. Allod VRM now publishes a security policy."
}