How verdicts work

Every finding gets exactly one verdict from a fixed, open set of rules — no black-box score. The rules are evaluated top to bottom; the first match wins.

The rules, in order

1. 1In CISA KEV (actively exploited) → Fix now
2. 2CVSS ≥ 9.0 → Fix now
3. 3CVSS ≥ 7.0 and EPSS ≥ 0.10 → Fix now
4. 4CVSS ≥ 7.0 → Plan
5. 5CVSS ≥ 4.0 or EPSS ≥ 0.01 → Plan
6. 6Unknown severity (no CVSS) → Plan
7. 7Otherwise → Informational

Sources

• OSV — Open-source vulnerability database — which components are affected and in which version ranges.
• CISA KEV — The US catalog of vulnerabilities known to be actively exploited in the wild.
• EPSS (FIRST) — A probability score (0–1) that a vulnerability will be exploited in the next 30 days.

Limits

No alert does not mean no vulnerability. Matching is based on package identifiers (purl) and version ranges; OS packages are matched on a best-effort basis. Verdicts are input for your own assessment, not a legal conclusion.

Rules version: 27 July 2026 (Commission guidance + FAQ).