What an entry needs. A date, a source and a status. Verified means the source was opened and the page, file or record itself names one of the records, the research repository or the author. Search-only and searched, not opened mean it was found, or ruled out, through a search engine or another site's listing, and the source itself was not opened. Unreachable and not reached mean the page refused the request or could not be read.
What the date is. The date the source gives for its own act: a publication time, a commit, a release date, a first-seen line on its own page. A database page that shows only the record's own publication date sits on the day it was first seen, and says so. A divergence sits on the date the source gives for the statement itself; where the source dates only its page, it sits on the day the statement was first seen. By this date marks a source that shows only a last-modified time, or a log of when something was noticed elsewhere. Dates are UTC; the times of reads are UTC+07.
Copies and work are counted apart. A copy reproduces a record or the research repository: a mirror, a feed, a page a site generates for every CVE, a bot ticket, a machine-written summary, an unsigned digest item, a fork. Work is something a named author or project did with the records: a bylined write-up, a change in a project. Much of it is produced with AI tools; where a source says so, the entry says so.
What the numbers count. The headline and the tiles count sources: a site and the repositories of the same organisation count once in a lane, however many entries they have there. A source that appears in two lanes is counted in each. Only verified entries count. The numbers beside the lanes and in the docket count entries.
What counts as a fix. Only the statement of the maintainer of the affected software, in a release note, commit, advisory or issue, that a change addresses one of the records. A database label that says a patch is available is listed under divergences.
What counts as verification. A party other than the author states that it tested and reports the result. Restating the advisory does not count.
What a divergence is. A third party states something the records do not support, or shows a score or label the records do not carry without naming its source. A statement that a patch exists is listed; general advice to update to a patched version is not. The wording and the scores of the official records are taken as they stand and are never listed here.
How it is kept. On each run, listed in the run log, a collector reads the registries, the package index and code search and writes what a machine can establish: a record changed state, a new repository carries the identifiers. Anything that needs a judgment waits for a reviewer who opens the page. Rows are never edited; a correction is a new row that replaces the old one.
Which sources count as registries and databases. The CVE Program, NVD, GitHub's advisory database, OSV, ENISA's EUVD, CIRCL, CISA, national CERTs, the security trackers of Linux distributions, and the vulnerability databases of scanner vendors that security teams query directly: here Tenable, Rapid7, Mend.io, Aqua and Positive Technologies. Any other site that generates a page for every CVE is counted as a copy. Where that line falls is a judgment made for this record. Two of the sixteen list the records without tying them to a package of their own: Debian marks them NOT-FOR-US, and Alpine's tracker shows no matching package.
Counted in two lanes. Aqua Security is counted among the registries for its database pages and among the copies for its NVD data repository. The intake bots of Sattyam Jain's two projects are counted among the copies as one source, and one of those projects, agent-audit-kit, under acted on, for the detection rule merged there. Adam Dudley's mcp-audit is counted under acted on, for the registry entry its advisory check reads, and under divergences, for the fixed version that entry states. pranava0x0/vibe-coding-security is counted among the copies, for its advisory file and its daily sweep, and under acted on, for the corrections and the mapping check made there.
Terms. CNA: the organisation that assigned the identifier. ADP Vulnrichment: the programme through which CISA adds scores and decisions to CVE records. SSVC: CISA's decision points for a record (exploitation, automatable, technical impact). EPSS: FIRST's estimate of the probability of exploitation in the next 30 days. Deferred: the status NVD currently gives the five records; it has added no analysis of its own to them.
