Security advisories

Every morning the register pulls GitHub Security Advisories — reviewed by their security team, rated high or critical, and naming an actual package — along with CISA’s Known Exploited Vulnerabilities catalog.

No entry is written by a model: ecosystem, affected versions, fixed version and score come straight from the cited advisory. Rewriting a version number would only add a chance of error to the one field you are going to copy.

A flaw listed by CISA is marked “actively exploited” and rated critical regardless of its score: a score measures potential, observed exploitation measures a fact.