Glossary

No signal currently raises the record above the baseline tier.

What to do this week: Review during routine vulnerability management.

A public exploit, elevated exploitation probability, or Stakeholder-Specific Vulnerability Categorization (SSVC) verdict raises this record for closer watching.

What to do this week: Watch for exploitation and prepare the likely fix.

The SSVC-style verdict calls for attention, but no confirmed exploitation signal sets an Act floor.

What to do this week: Plan remediation this week and confirm ownership.

Confirmed active exploitation or an SSVC-style Act verdict requires prompt action.

What to do this week: Prioritize remediation now and verify compensating controls.

Ransomware association sets the top tier; active exploitation can also rise one tier through the end-of-life or open-exposure modifier.

What to do this week: Respond now and verify containment, remediation, and exposure.

The tracker directly observed the stated event or measurement in source data.

An independent external source supports a claim but is not the primary record.

The named source asserted this fact, and the tracker is reporting that assertion.

The subject or publisher supplied this information about itself.

A source made this claim, but the tracker has not confirmed the underlying event independently.

The tracker calculated this value deterministically from named inputs.

The tracker inferred this interpretation from source data, so it is not a source assertion.

When the source says it first published the item.

When the source says it last updated the item.

When the tracker last retrieved this source successfully.

The latest source or computation time represented in this tracker view.

When a tracked field with reader impact last changed.

Listed in the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog.

Listed in the VulnCheck Known Exploited Vulnerabilities catalog as observed exploitation.

Listed as exploited in the European Union Agency for Cybersecurity European Vulnerability Database.

The strongest exploitation state supported by the tracker signals for this vulnerability.

A tracked signal confirms exploitation in the wild and sets an Act floor.

Public code or instructions demonstrate exploitation, which can set a Track* floor.

A tracked catalog links the vulnerability to ransomware activity, which sets Act now.

The remediation deadline set for United States federal civilian agencies under a binding directive.

A tier-major number used to sort vulnerabilities by tier first and then by urgency within that tier.

The Common Vulnerability Scoring System severity score reported by an identified source and version.

The Exploit Prediction Scoring System estimate of exploitation probability during its published horizon.

A tracker-computed Stakeholder-Specific Vulnerability Categorization decision using named deployer inputs.

Whether exploitation can be reliably automated across targets under the SSVC decision model.

The SSVC input describing whether exploitation gives partial or total control of the affected system.

A Common Weakness Enumeration category describing the underlying weakness type.

A product-class estimate that can raise an actively exploited or ransomware-associated item by one tier only when exposure is open.

A product lifecycle flag that can raise an actively exploited item by at most one tier.

A within-tier signal for impact that crosses the initially vulnerable component boundary.

A severity score from the European Union Agency for Cybersecurity European Vulnerability Database, shown while NVD analysis is absent.

A Common Vulnerabilities and Exposures identifier for one publicly disclosed vulnerability record.

The United States National Vulnerability Database, used here as one source of vulnerability analysis.

The CVE Numbering Authority that assigned or published information for the record.

An Authorized Data Publisher that adds analysis to a CVE record without replacing the assigner.

Open Source Vulnerabilities, an open database and data format for vulnerabilities in open-source packages. The malicious-package reports here are published in this format.

The Common Security Advisory Framework, a machine-readable format that the Cybersecurity and Infrastructure Security Agency and many vendors use to publish security advisories.

Software composition analysis, tooling that lists the open-source components in an application and checks them against known vulnerabilities.

The Federal Civilian Executive Branch, the United States federal civilian agencies that Cybersecurity and Infrastructure Security Agency directives bind.

An Industrial Control Systems Medical Advisory, a Cybersecurity and Infrastructure Security Agency advisory about a vulnerability in a medical device.

The MITRE Adversarial Tactics, Techniques, and Common Knowledge catalog used for actor and technique mappings.

A compulsory Cybersecurity and Infrastructure Security Agency direction for United States federal civilian agencies.

An urgent Cybersecurity and Infrastructure Security Agency direction issued for a known or reasonably suspected information security threat.

The directive remains in force in the curated directive record.

A newer directive replaced this directive.

The issuing authority withdrew this directive.

The curated record marks this directive as no longer active.

A direct release or public record from a tracked government agency.

A news story selected because its headline or opening sentence states an enforcement action. Cyberstalking, sextortion, online threats, and swatting stay off as a subject, and cyber-enabled fraud is listed only for business email compromise, a crypto-laundering service, or a North Korean IT-worker scheme. Not an official record.