How to read a vulnerability
What the words and numbers on this site mean, and which ones to act on first.
What is a CVE?
A vulnerability is a flaw in software that an attacker could use to do something they shouldn’t, like read private data or take over a server.
A CVE is the public name for one of those flaws. CVE-2014-0160, for example, is the Heartbleed flaw in OpenSSL. The first number is the year the ID was assigned, and the second tells it apart from the others. An ID says a flaw has been catalogued, not how dangerous it is.
You’ll also see other IDs for the same kinds of problem, like GHSA from GitHub and MAL for malicious packages. Every CVE merges the IDs for one flaw into a single record.
Severity: how bad could it be?
CVSS scores a flaw from 0 to 10 by how much damage it could do. It doesn’t say whether anyone is actually using it.
| Level | Score | Usually means |
|---|---|---|
| 9.8 Critical | 9.0–10 | An attacker can get in remotely, with little or no access to start with. |
| 7.5 High | 7.0–8.9 | Serious damage is possible, sometimes with a condition or two. |
| 5.3 Medium | 4.0–6.9 | A real problem, but limited or harder to pull off. |
| 2.4 Low | 0.1–3.9 | Little impact, or the attacker needs unusual access first. |
“No score” means nobody has rated it yet. It doesn’t mean the flaw is harmless.
EPSS: how likely is an attack?
EPSS estimates the chance that attackers try to exploit a flaw in the next 30 days. Most flaws score very low, so the percentile helps: the 95th percentile means it’s more likely to be exploited than 95% of scored flaws.
Other signs to look for
- In KEV
- On the Known Exploited Vulnerabilities list from CISA, the US cybersecurity agency. Attackers are using this flaw in real attacks.
- Public exploit
- Attack code or instructions are public, so it takes less skill to use the flaw. We link to these listings and never host the code.
- Fix available
- At least one source names a version that fixes the flaw.
- Disputed
- Someone, often the software’s maker, argues this isn’t a real flaw.
- Rejected Withdrawn
- The report was pulled, for example because it was a duplicate or a mistake.
What should I do first?
- Check that you run it. Search for your package or product. The entry lists which versions are affected.
- Start with anything in KEV. Those are under attack now.
- Then go by EPSS and severity. A medium flaw under attack can matter more than a critical one nobody is using.
- Update to a fixed version. If there’s no fix yet, check the entry’s references for the maker’s advice.