Cyber Risk Compendium

Vulnerability

A vulnerability is a (real or possible/feasible) flaw or weakness in an assets design, implementation, operation or management that could be exploited by a threat.

 

Read: A risk is a threat to an asset that makes use of a specific type of vulnerability the asset has (or might have).

 

Where to look up known vulnerabilities

Rather than maintaining our own vulnerability database, use these established sources to look up known vulnerabilities (CVEs) for the software and hardware you operate:

  • CVE.org (MITRE) — the canonical, vendor-neutral list of publicly disclosed vulnerabilities, each with a unique CVE identifier: cve.org

  • NVD (NIST National Vulnerability Database) — enriches CVE entries with severity scores (CVSS), affected products, and references: nvd.nist.gov

  • CISA Known Exploited Vulnerabilities (KEV) Catalog — a much shorter, high-signal list of vulnerabilities known to be actively exploited in the wild; a good prioritization filter on top of the full CVE list: cisa.gov/known-exploited-vulnerabilities-catalog

  • GitHub Advisory Database — vulnerabilities in open-source packages, searchable by ecosystem (npm, PyPI, Maven, etc.), useful for dependency scanning: github.com/advisories

  • OSV.dev (Open Source Vulnerabilities) — a machine-readable aggregator of open-source vulnerability data, well suited to automated tooling: osv.dev

  • BSI WID / CERT-Bund — German federal advisories, often among the fastest sources for vulnerabilities affecting widely used enterprise software: wid.cert-bund.de

  • VulDB — a Swiss-run (Basel) vulnerability database offering additional exploit and threat-intelligence context, partially commercial: vuldb.com

  • Vendor security advisories (e.g. Microsoft MSRC, Adobe PSIRT, Cisco PSIRT) — often the first and most detailed source for a vulnerability in a specific product you use.

For most SMEs, checking the CISA KEV list and subscribing to vendor advisories for your core software stack covers most of the practical need. The full CVE/NVD databases are better used for targeted lookups than for continuous monitoring, unless you have dedicated vulnerability management tooling in place.