Securaity Browse advisories

Sources and licenses

Where Securaity's vulnerability data, exploit status, vendor policy details and standards come from, the licenses that apply, and how to report an error.

Securaity builds its advisories and tool profiles from public records that you can check yourself. Most of the vulnerability data is US government work in the public domain. The GitHub material is under an open license that requires credit. This page lists each source, the terms that apply to it, and how we use it, so you can judge whether our pages are fit to cite in your own risk records.

Vulnerability data

We read CVE records from the National Vulnerability Database (NVD), which the US National Institute of Standards and Technology (NIST) runs. We use the NVD CVE API 2.0. NVD data is US government work, so it is not subject to copyright in the United States. NVD asks API users to include this notice, and we do:

“This product uses the NVD API but is not endorsed or certified by the NVD.”

We also read advisories for the pip, npm and Go ecosystems from the GitHub Advisory Database through the GitHub REST API. That content is licensed under Creative Commons Attribution 4.0 (CC BY 4.0), which means we credit GitHub wherever we use it. GitHub is the CVE numbering authority for many of these records. That is why some descriptions you see on this site include Markdown headings: they come that way from the original record.

Known-exploited status

The US Cybersecurity and Infrastructure Security Agency (CISA) publishes the Known Exploited Vulnerabilities (KEV) catalog as public US government data. We read the JSON version of the catalog every day. When an advisory’s CVE appears in the catalog, we mark that advisory “known exploited.” For your purposes, that label means attackers are using the flaw in practice, and you should not wait to act.

Vendor policy pages

Tool safety profiles rely on the vendor’s own documents. These are the privacy notice, the FAQ on data usage or model training, and any enterprise or trust pages. Each one is cited with the date we checked it. Vendors change these pages without notice, so the date tells you how current our reading is. We paraphrase the facts. When we quote, the quotation is short and attributed.

Standards and frameworks

Our guides and course refer to these published standards and frameworks:

  • OWASP Top 10 for LLM Applications (OWASP GenAI Security Project)
  • NIST AI Risk Management Framework
  • MITRE ATLAS
  • ISO/IEC 42001
  • EU AI Act (Regulation (EU) 2024/1689)
  • CVSS v3.1 specification from FIRST

How sources are used

We follow the same rules for every source:

  • Vulnerability descriptions are quoted word for word and attributed.
  • Everything else is paraphrased from the record.
  • No source is altered.
  • Every advisory links to its original record.
  • Every tool profile links to the vendor pages it used.

Outbound links in a Sources section on this site are marked so that search engines do not treat them as endorsements. This rule applies to every source equally.

Reporting an error

Where you send a correction depends on where the mistake is.

  • The source record is wrong. Report it to that source: NVD, GitHub or the vendor. We will pick up the fix the next time we read the record.
  • We showed it wrong. Email Securaity through the contact page. Tell us which page has the problem and what is wrong.

Published Updated

Sources