Linux Kernel CVE Records: Read Stable-Branch Affected Ranges
Every Linux kernel CVE record carries two product entries: git commit ranges and kernel version ranges. We read all 7,987 kernel CNA records published …
Tag
Cve
CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
CVE cpeApplicability: CPE Match Nodes, Operators, Ranges
Since CVE Record Format 5.1.1, a CNA can put CPE Applicability Language statements in a cpeApplicability block. Here is how nodes, operator, negate, …
CVE ADP Containers: CISA-ADP, CVE Program and Supplier ADPs
A CVE record has one CNA container and possibly several ADP containers. Here is what CISA-ADP, the CVE Program Container and supplier ADPs such as …
CVE Affected Versions: lessThan, defaultStatus, versionType
The affected block in a CVE record is a small algorithm, not a list. Here is how version, lessThan, lessThanOrEqual, changes, versionType and …
Vulnerability Prioritization Workflow: CVE Record to Ticket
A six-step patch-decision flow that takes a scanner finding from CVE record to ticket: check the record state, confirm you are affected, apply …