Transparent by design
CVE data sources and matching methodology
VulniPulse organises security advisories for defensive prioritisation. It does not replace vendor guidance. Every remediation decision should be confirmed against the linked source.
1. Source hierarchy
We prioritise official vendor PSIRT, security advisory, CNA, CSAF, RSS and documented API sources across 34 enabled vendors. CVE.org, CISA KEV and NVD can enrich identifiers, exploitation and scoring context. Secondary lifecycle data is labelled and cannot override an official vendor statement.
2. Ingestion and change tracking
Sources are polled automatically and records are normalised into a common advisory model. We retain vendor advisory IDs, CVEs, products, affected and fixed releases, severity, publication dates and source URLs where supplied. Changed advisories are reprocessed so corrections and new fixes can flow through matching.
3. Product and platform matching
Vendor names and product aliases are mapped to canonical categories—for example, FortiGate guidance may map to FortiOS, and vSphere Hypervisor guidance may map to ESXi. Vendor watches match the full vendor feed; platform watches require a canonical platform signal. Ambiguous product evidence is not promoted to a precise match.
4. Version evidence
Exact-version checks use vendor APIs where a documented integration exists, such as Cisco PSIRT openVuln for supported software families. Other products combine parsed vendor advisory ranges, recognised release catalogs and lifecycle context. A missing affected-version range is unknown—not proof that a release is safe.
5. Confidence and safe failure
A confirmed affected result requires compatible product evidence and a defensible version comparison. Unparseable or incomplete release data is surfaced for review. Products with no held advisory evidence receive a no-data state instead of a green all-clear.
6. Prioritisation
VulniPulse surfaces vendor severity, CVSS when supplied, CISA KEV membership, exploitation evidence, fix availability and end-of-support state. Operators should combine those signals with internet exposure, asset criticality, compensating controls and change risk.
7. Alert delivery
After a newly ingested advisory matches an active rule, VulniPulse queues the enabled email, push or Discord delivery path. Delivery time depends on source publication, polling, matching and the downstream provider; no page should be interpreted as a delivery-time SLA.
8. Corrections and limitations
Vendor pages, APIs and release formats change. Some vendors expose complete machine-readable catalogs; others publish product-specific tables or gated portals. Coverage labels and source links make those differences visible. Use the Suggestions page to report a missing platform, incorrect match or stale source.
How to read an advisory or CVE page
- Identity and scope
- A vendor notice can discuss several CVEs, and one CVE can appear in several vendors' notices. A rating or fix shown for an associated advisory is not automatically a rating or fix for every CVE in that notice. Comparative CVE pages keep each vendor's evidence separate.
- Affected versus related products
- A confirmed affected-product statement requires vendor or CNA affected-product evidence. Inferred tags help discovery but are not proof of exposure. Always check the exact version and configuration against the linked source.
- Severity, prediction and observed exploitation
- CVSS describes severity, not your organisation's complete risk. EPSS estimates exploitation probability over the next 30 days; it does not confirm an attack. A CISA KEV label on a CVE page requires a match for that exact CVE. Absence from KEV does not establish that a vulnerability is unexploited.
- Dates and corrections
- Vendor publication and revision dates belong to the original source. VulniPulse first-seen and content-update dates describe this service's processing. Checking an unchanged feed is not a new disclosure or a content revision. Lifecycle “sources checked” dates are retrieval evidence, not newly announced support milestones.
Primary references: FIRST CVSS guidance, FIRST EPSS, CISA's official KEV data, and the CVE Program record collection.
Coverage and corrections
VulniPulse covers its supported vendor sources, not every CVE ever assigned. Source availability, historical coverage and publication formats vary. Our pages link to original evidence so you can verify a decision and report a discrepancy.
To request a correction, use Suggestions and include the advisory or CVE URL, the disputed field and an official source. Do not include credentials, private inventory or confidential incident data.