ZeroDay Findings
Sign inSign up

Guide

How to read a vulnerability record

A CVE page on this site answers three questions: do you need to act, are you running an affected version, and where is the vendor fix. Scores support that decision. They are not the decision.

Start with the action, not the score

  • Patch now

    The record is in the CISA Known Exploited Vulnerabilities catalog. Someone is already using it. Schedule the vendor fix. If CISA published a due date, that date is on the page.

  • Check this week

    It is not in CISA KEV, and FIRST EPSS is at least 10%. That is a probability of exploitation in the next 30 days, not proof that you are exposed. Check whether the product is installed.

  • Check if you run it

    No confirmed exploitation, and EPSS is under 10%. Act only when a listed version is in production.

  • Open the advisory

    EPSS is missing. That is a data gap, not a low score. Read the vendor advisory before you close the ticket.

What each number is for

CISA KEV
Confirmed exploitation in the wild. This outranks CVSS. A critical score without a KEV listing is not the same job as a medium score that is already being used.
EPSS
A probability from 0% to 100%, published by FIRST, for exploitation in the next 30 days. It is not a severity score and it cannot exceed 100%.
CVSS
Technical impact if the vulnerability is reachable. Use it to understand the effect. Do not use it alone to order the week's patches.
Affected ranges
The versions stored from public advisories. The version checker on a CVE page compares what you type with those ranges. A missing range means the catalog does not know, not that every version is safe.

A practical order of work

  1. Open known exploited and patch anything you actually run.
  2. Open the technology hub for each product in production and read the version page that matches your major release.
  3. On a CVE, enter your installed version before you read the rest of the page.
  4. Follow the vendor advisory link. This catalog stores the record and the link. It does not replace the advisory, and it does not publish exploit steps.

Where the longer coverage lives

  • Cyber news

    Incidents and advisories, linked back to catalog records.

  • Tech news

    Product changes that matter to the stack you run.

  • Security updates this week

    What changed in the catalog over the last seven days.

  • Sources

    Which feeds supply KEV, EPSS, advisories, and package ranges.