Our sources: where SecureRoot gets its vulnerability data
Every vulnerability page on SecureRoot is built from public data published by the organisations below, and links back to them. If a page and the vendor's own advisory ever disagree, trust the vendor.
| Source | What we use it for |
|---|---|
| CISA Known Exploited Vulnerabilities catalog | Which vulnerabilities are being exploited in the wild, the date they were added and CISA's required action. |
| CVE.org (CVE Program, operated by MITRE) | The official CVE record: description, affected versions and the reporter's references. |
| National Vulnerability Database (NIST) | CVSS severity scores, weakness types (CWE) and affected product names. |
| FIRST EPSS | The Exploit Prediction Scoring System: the estimated chance that a vulnerability is exploited in the next 30 days. |
| Debian security tracker | Fix status and fixed package versions for Debian releases. |
| Ubuntu CVE tracker | Fix status and fixed package versions for Ubuntu releases. |
| Red Hat security data | Fixed packages and advisories (RHSA) for Red Hat Enterprise Linux, which AlmaLinux, Rocky Linux and Oracle Linux follow closely. |
| Node.js Security Working Group | Affected and patched Node.js release lines. |
| endoflife.date | Current versions and support dates on the distributions page. |
Curated pages
For the most important vulnerabilities we add checked notes: exact fixed versions, workarounds and detection hints, each taken from the vendor's advisory, the project's release notes or a reputable security researcher, and listed in the page's Sources section.
Guides
Our guides are written from the official documentation of each system and tool (manual pages, vendor lifecycle pages and handbooks) and every guide lists the pages it relied on.