https://lesitedefrancois.be/en/tags/vulnerability-management/Recent content in Vulnerability-Management on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/cvss/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/cvss/<p><strong>CVSS (Common Vulnerability Scoring System)</strong> is an open framework published by FIRST (Forum of Incident Response and Security Teams) for characterising and communicating the technical severity of software vulnerabilities through a standardised numerical score. The current version is <strong>CVSS v4.0</strong> (released November 2023), which introduced a fourth metric group and clarified nomenclature to address the persistent misuse of CVSS Base scores as standalone risk measurements. CVSS scores appear in the NVD (National Vulnerability Database), CVE entries, scanner output from Qualys, Tenable, Rapid7, Grype, and Trivy, and in compliance frameworks that specify remediation SLAs based on severity bands — &ldquo;critical (9.0–10.0) within 15 days, high (7.0–8.9) within 30 days.&rdquo; The score ranges from 0.0 (no impact) to 10.0 (maximum severity) and maps to five qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0).</p>https://lesitedefrancois.be/en/security/kev/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/kev/<p>The <strong>CISA Known Exploited Vulnerabilities (KEV) Catalog</strong> is a living database maintained by the US Cybersecurity and Infrastructure Security Agency that lists CVEs for which CISA has obtained reliable evidence of active exploitation in the wild. It was established under <strong>Binding Operational Directive 22-01 (BOD 22-01)</strong>, issued in November 2021, which requires all US Federal Civilian Executive Branch (FCEB) agencies to remediate KEV-listed vulnerabilities within prescribed timeframes — typically 2 weeks for critical vulnerabilities and up to 6 months for older ones. A vulnerability must meet three criteria to be added: it must have a <strong>CVE ID</strong>, there must be <strong>reliable evidence of exploitation in the wild</strong> (not just a proof-of-concept or theoretical risk), and there must be <strong>clear remediation guidance</strong> available. CISA accepts nominations from the public and adds vulnerabilities continuously; the catalog is available in CSV and JSON formats at a stable URL, making it machine-consumable for integration into vulnerability management platforms and asset inventory tools.</p>