Methodology
How the facts on this site are sourced, verified, and kept current, and what the vulnerability database includes.
Sources
- Every fact comes from a source page fetched for that purpose. Memory, search snippets, and AI summaries do not count as sources.
- Primary sources come first: the project's own repository and documentation, the vendor or certification issuer, the standards body (MITRE, NIST, CISA, FIRST, IANA, IETF), or the original disclosure.
- News outlets and research blogs only support a primary source. Intel articles are the exception when they report what an outlet published, and they name that outlet.
- A vendor describing itself is not evidence of market position. Words such as "leading" or "the standard" stay only when an independent source supports them.
Verification
Each fact is stored in an evidence ledger, one record per claim: the page field it supports, the source URL, a verbatim quote from that source, and the date it was checked. The ledger holds 13,777 claims across 707 pages, drawn from 3,434 distinct source URLs.
- A script fetches every source again and fails when a quote is no longer on the page. It runs before content changes are published and at each quarterly review.
- A second check fails when a text field on a page has no ledger record behind it, so unsourced text does not get published.
- Editing the text of a verified field invalidates its records until they are checked again.
- When no source supports a claim, the text is cut back to what the sources state, or removed.
- Field
- license
- Claim
- Nmap Public Source License version 0.95
- Source
- https://raw.githubusercontent.com/nmap/nmap/HEAD/LICENSE
- Quote
- "nmap public source license version 0.95"
- Checked
- 2026-10-10
Freshness
- Facts with a published end date, such as a price valid until a given day or an exam version that retires, are recorded with that date. Once it passes, the verification check fails until the page is updated.
- Facts likely to change, such as prices and announced exam changes, carry a recheck date by which the source is fetched again.
- Each tool page shows the date its profile was last verified. Each certification page shows the date it was last checked against the issuer's pages, and a check older than 120 days is flagged for review.
- Intel articles are checked as of their publish date. Errors found later are corrected in place; developments after publication are added as dated update notes.
- Vulnerability records sync from their feeds every 12 hours.
Vulnerability Data
Data feeds
- CVE List: the official list of CVE records, published as the cvelistV5 repository. Record descriptions, affected products, references, and CVSS scores come from it.
- CISA KEV catalog: CISA's list of vulnerabilities exploited in the wild. Each entry carries a required action and a remediation due date.
- EPSS: a model maintained by FIRST that estimates the probability that a published CVE will be exploited in the wild in the next 30 days. Scores range from 0 to 1 and are published daily for every CVE.
What is included
- Every CVE in the CISA KEV catalog, from any year.
- CVE IDs from 2026 onward with an EPSS score of at least 0.1, or with a reference tagged as an exploit and an EPSS score of at least 0.05.
- Only records in the published state count. Records whose description is a placeholder are skipped unless KEV lists them, and Linux kernel CVEs appear only when they are in KEV.
- Vendor pages cover vendors with at least 10 records in the database, and weakness (CWE) pages cover weaknesses with at least 5. Both recompute on every build.
- Record pages show the CVSS base scores that the assigning CNA and CISA add to the CVE record, each labeled with its source.
Tools and Certifications
- Each tool category lists the tools that exist for that task, open source and commercial. Tools carry no scores, ratings, or rankings, and no listing or position is paid for.
- License, platforms, and pricing model come from the project's repository, documentation, release files, package listings, and pricing page.
- A tool is marked deprecated only when its maintainers state that it is unmaintained or discontinued. Inactivity alone does not count.
- Certification exam facts come only from the issuer's own pages. A fact the issuer does not publish shows as "Not published" and is never estimated. Certification pages carry no salary figures.
Limitations
- The vulnerability database holds 1,910 records selected by the rules above, not every published CVE. A CVE missing here says nothing about whether a product is affected.
- Sources change between checks. Prices, exam details, and licenses can change after the date shown on a page, and the vendor or issuer page is the authority.
- The verification check confirms that a quote is still on its source page. It does not judge whether the source itself is correct.
- An EPSS score is a probability estimate, not a record of exploitation. Only KEV entries carry confirmed exploitation in the wild.
Frequently Asked Questions
Why is a CVE missing from the vulnerability database?→
The database lists every CISA KEV entry, plus CVE IDs from 2026 onward with an EPSS score of at least 0.1 or an exploit reference backed by an EPSS score of at least 0.05. Other CVEs are not listed.
How often is the content updated?→
Vulnerability records sync every 12 hours. Tool and certification pages show the date they were last verified, and their sources are fetched again before content changes and at each quarterly review.
Are tools ranked, rated, or sponsored?→
No. Category pages list the tools that exist for the task, with no scores, ratings, or paid placements. Each profile describes what the tool does, its license, platforms, strengths, and limitations, as stated by its sources.
What does "Not published" mean on a certification page?→
The issuer does not publish that fact on its own pages, a passing score for example. The field stays empty instead of showing a figure from a third party.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, CISA, or FIRST.