Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisories · Critical

What needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

  1. KEV

    It’s in CISA’s KEV catalogue

    CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.

  2. CVSS 9+

    Its CVSS score is 9.0 or more

    The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.

  3. CVSS 7+ and EPSS

    CVSS 7.0 or more, and EPSS 0.1 or more

    A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check your lockfile or follow this list with RSS.