Glossary

Unique public identifier of a vulnerability (Common Vulnerabilities and Exposures), shaped CVE-year-number.

Reference definition: CVE Program (external site)

Organization authorized to assign CVE identifiers and publish their record, often the vendor of the affected product.

Reference definition: CVE Program (external site)

Organization that enriches a CVE record published by a CNA, for example CISA with scores, CPEs or an SSVC decision.

Reference definition: CVE Program (external site)

Scoring system for the technical severity of a vulnerability, from 0 to 10, always given with its version (3.1, 4.0).

Reference definition: FIRST (external site)

Class derived from the CVSS score: critical (9 to 10), high (7 to 8.9), medium (4 to 6.9), low (below 4).

Reference definition: FIRST (external site)

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days. Published daily by FIRST and always dated.

Reference definition: FIRST (external site)

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation.

Reference definition: CISA (external site)

CISA decision method. TACTIC keeps its exploitation signal (active, proof of concept, none).

Reference definition: CISA (external site)

Catalog of software weakness types (injection, buffer overflow…) that make a vulnerability possible.

Reference definition: MITRE (external site)

Standard name of a product. Its first letter gives the type: o for an operating system, a for an application, h for hardware.

Reference definition: NIST (external site)

Identifier of a GitHub Advisory Database advisory, focused on software packages (npm, pip, Maven, Composer).

Reference definition: GitHub (external site)

Sharing code for information (CLEAR, GREEN, AMBER, RED) telling who it may be shared with.

Reference definition: FIRST (external site)

Confirmed (KEV catalog), reported (SSVC active), not reported (explicit statement) or unknown. The unknown is never shown as an absence.

See the TACTIC methodology

Urgent, high, normal or low, computed by public, versioned rules. Every priority cites its reasons.

See the TACTIC methodology

Quality of the sources behind a record. It is not a risk score.

See the TACTIC methodology

Single file per vulnerability gathering every source: twenty articles about the same CVE make one record.

See the TACTIC methodology

A change worth attention: new record, KEV addition, confirmed exploitation, changed versions, fix, priority increase, withdrawal.

See the TACTIC methodology

Operating system, application, hardware or software library, derived from published CPEs or a mapping table. Otherwise unknown.

See the TACTIC methodology

Functional category of the product (firewall, hypervisor, antivirus, OT software…), given by the TACTIC mapping table. Otherwise unclassified.

See the TACTIC methodology