CVE

name: zetlyn/cve
title: CVE
about: What each publisher says about a vulnerability, whether working code exists for it, and what is written about it afterwards.
sources:
- source: zetlyn/cve-kev
  priority: primary
  why: The only source that says a vulnerability is being exploited right now.
- source: zetlyn/cve-redhat
  priority: high
  why: Its own severity, and the packages it tracks a vulnerability in.
- source: zetlyn/cve-nvd
  priority: high
  why: The CVSS baseline, and an anchor for CVEs the other members never reach.
- source: zetlyn/cve-ghsa
  priority: high
  why: The ecosystem packages no distribution ships.
- source: zetlyn/cve-metasploit
  why: Whether a module exists for the tool an attacker actually runs.
- source: zetlyn/cve-exploitdb
  why: Whether working code exists at all, which is a different question from how severe it is.
- source: zetlyn/cve-writeups
  why: The prose that explains a vulnerability after the advisories have stopped.
identified_by:
- cve
# What a vulnerability is to something else, where a claim states both: NVD names the CPEs of what
# it affects once it has analysed a CVE. Where it has not, the CNA's own words are offered to a
# person to confirm, and a match they confirm is theirs, signed, in matches.jsonl.
relations:
- name: affects
  to: cpe
  as: product
  suggest_from: [vendor, product]
  about: The products it affects, as vendor/product.
- name: made_by
  to: cpe
  as: vendor
  suggest_from: [vendor]
  about: The vendors whose products it affects.
align:
  # The same number from every source that scores one: NVD, Red Hat and GitHub all give a CVSS
  # base score, and a difference between them is a difference of judgement.
  cvss: {}
  # Exploited means somebody is using it, and one source says that: CISA, by putting the row in
  # its catalogue. Metasploit's rank and Exploit-DB's verified flag are about the code, not about
  # the attack — a module that nobody has fired and an unverified proof of concept are both code
  # that exists. That question is already answered, by a claim of kind `exploit`, and 23,444
  # things carry one. Reading the two as one property makes `exploited=yes` useless for triage.
  exploited:
    scale:
    - "yes"
    - "no"
  severity:
    scale:
    - critical
    - high
    - medium
    - low
    - unknown
    zetlyn/cve-ghsa:
      critical: critical
      high: high
      low: low
      moderate: medium
    zetlyn/cve-redhat:
      critical: critical
      important: high
      low: low
      moderate: medium
view:
  columns:
  - kind
  - severity
  - cvss
  - known
  facets:
  - kind
  - source
  - severity
  - exploited
  sort: known desc
  named:
  - name: exploited-and-severe
    title: Exploited, and severe
    where: exploited=yes and severity>=high
  exploit:
    adopt: zetlyn/cve-exploitdb:verified
promise:
  fresh_within: 24h
  covers: Every CVE in CISA KEV. Red Hat since 2025-01-01, NVD since 2026-08-01, GitHub since 2026-09-01. Every Exploit-DB entry and Metasploit exploit module naming a CVE.
  excludes: Vulnerabilities with no CVE number. Ubuntu, whose list endpoint answers 20 records in thirty seconds and cannot be paged at a useful rate.