FAQ

A unique identifier assigned to one security vulnerability. The most common format is the CVE ID, CVE-YYYY-NNNNN, assigned by CVE Numbering Authorities (CNAs). It gives every system and database the same way to reference and track an issue.

CVE-2024-27305  # a vulnerability disclosed in 2024

Alternative identifiers for the same vulnerability. Databases often assign their own IDs before a CVE exists, or use their own naming conventions.

The Common Vulnerability Scoring System rates the severity of a vulnerability from 0.0 to 10.0. Versions 2.0, 3.0, 3.1 and 4.0 each refine the scoring method.

The Exploit Prediction Scoring System estimates the probability that a vulnerability is exploited in the wild within the next 30 days. CVSS measures severity; EPSS measures likelihood, based on threat intelligence and exploit availability.

Other security issues connected to the current one. Relationships show the broader context and possible impact chains.

Known Exploited Vulnerabilities (KEV) catalogs list vulnerabilities with evidence of active exploitation in the wild. CveMate ingests three of them. The catalogs disagree, so each record shows which ones list it and when it was added.

Code, commands or techniques that take advantage of a vulnerability to compromise systems, steal data or gain unauthorized access. A public exploit sharply raises the risk, because attackers can use it as-is.

A 0 to 100 score that combines several signals into one number, so you can sort by what to fix first. It is CveMate's own model, not an official rating, and the model used is named under the score.

SSVC (Stakeholder-Specific Vulnerability Categorization) answers a different question: what to do. For many CVEs CISA publishes three inputs in the CVE record: exploitation (none, PoC or active), automatable (no or yes) and technical impact (partial or total). CveMate runs them through CISA's decision tree and shows one of four decisions, with its source and date. The tree has a fourth input, mission and well-being, that depends on your environment and that CISA does not publish, so CveMate assumes the highest value: the decision is a worst case. When CISA has no entry yet, usually for a brand-new CVE, CveMate estimates the three inputs from its own data and labels the decision Estimated; the estimate is replaced when CISA publishes. With no CVSS and no CISA entry, no decision is shown.

The specific packages, libraries or components that contain a vulnerability. They tell you exactly which dependencies need updating.

A standard format for identifying a software package across ecosystems and registries. It references a package the same way regardless of package manager, which keeps vulnerability matching consistent.

pkg:type/namespace/name@version?qualifiers#subpath

pkg:npm/lodash@4.17.20
pkg:pypi/django@3.2.5
pkg:maven/org.apache.commons/commons-lang3@3.12.0
pkg:gem/rails@7.0.4

A community-developed list of software and hardware weakness types. A CWE names the root cause of a vulnerability — what went wrong and how to prevent it next time.

CWE-79  # Cross-site scripting: improperly neutralized input lets an attacker inject scripts

A standard naming scheme for applications, operating systems and hardware. A CPE name specifies exactly which systems a vulnerability affects.

cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other

cpe:2.3:a:apache:http_server:2.4.41:*:*:*:*:*:*:*  # Apache HTTP Server 2.4.41