Methodology
How a record is built, qualified and published. Rules are versioned and every priority cites its reasons.
Priority levels
- Urgent
- The vulnerability is in the KEV catalog: exploitation confirmed.
- High
- Exploitation reported by CISA (SSVC active), or a CVSS score of 9.0 or more.
- Normal
- CVSS score of 7.0 or more, or severity still unknown. The unknown never lowers the priority.
- Low
- Known CVSS score below 7.0, or a rejected or withdrawn record.
When an event is published
A new record, a KEV addition or removal, confirmed exploitation, changed affected or fixed versions, an available fix, a priority increase, a withdrawal or a correction. Collecting the same data again publishes nothing.
What is unknown stays unknown
Missing information is shown as unknown, never as false. Absence from the KEV catalog does not prove absence of exploitation. The EPSS probability will be shown with its date once collected.
Sources and redistribution
Each source declares its redistribution terms. A source's text is republished only when it allows it. Otherwise only facts (scores, products, versions, dates) and the link to the source are shown.
- CISA Known Exploited Vulnerabilities
- Confirmed exploitation. Text republished.
- CVE Program (cvelistV5)
- CNA records and CISA enrichment. Facts and links only.
- GitHub Advisory Database
- GHSA advisories per package. Format being verified.