By Null Ventures MCP platform
Menu

Coverage & method

A useful signal has
visible limits.

See what is collected, when a complete checkpoint was reached, and what still needs interpretation. Fetching a page is not the same as processing every record in a scope.

Collection status

1 of 13 configured scopes have a complete checkpoint. Some scopes are incomplete, delayed, disabled or awaiting their first run.

See coverage & limits ↗

Collection, by scope

Status evaluated . Incomplete backfills and unresolved processing gaps remain visible. A quiet source can be healthy only after a verified complete check.

cisa-kev

degraded

Complete CISA Known Exploited Vulnerabilities catalog; linked third-party material excluded.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

cve-list-v5

degraded

Commit-pinned CVE records referenced by the intake registry. Full CVE history is not covered.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

first-epss

degraded

Daily EPSS enrichment for CVE identifiers already present in the registry. Missing scores remain unknown.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
1440 / 2160 minutes
Processing status
normalization gap

github-malware

degraded

GitHub malware lane; full historical pagination remains partial until bootstrap finishes.

Last successful fetch
Last complete checkpoint
Not supplied
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

github-reviewed

degraded

GitHub reviewed lane; full historical pagination remains partial until bootstrap finishes.

Last successful fetch
Last complete checkpoint
Not supplied
Check interval / stale threshold
15 / 60 minutes
Processing status
partial fetch

github-unreviewed

degraded

GitHub unreviewed lane; full historical pagination remains partial until bootstrap finishes.

Last successful fetch
Last complete checkpoint
Not supplied
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

node-publisher

degraded

Official vulnerability index and approved linked notices; grouped CVEs remain distinct. Editorial summaries require review.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
60 / 180 minutes
Processing status
normalization gap

nvd

degraded

NVD enrichment for registered CVE identifiers; resumable modified-window backfill is optional. Associated CPE edits have separate freshness.

Last successful fetch
Last complete checkpoint
Not supplied
Check interval / stale threshold
120 / 360 minutes
Processing status
scope expanded

osv-npm

degraded

OSV npm delta index. GHSA-origin data permitted; other publishers retained for rights review. Historical bootstrap is explicit.

Last successful fetch
Last complete checkpoint
Not supplied
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

osv-packagist

degraded

OSV Packagist delta index. GHSA-origin data permitted; other publishers retained for rights review. Historical bootstrap is explicit.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

osv-withdrawals

degraded

OSV [EMPTY] delta index. GHSA-origin data permitted; other publishers retained for rights review. Historical bootstrap is explicit.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
15 / 60 minutes
Processing status
normalization gap

php-publisher

degraded

PHP 8 changelog and current support table; factual intake, reviewed publication only.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
60 / 180 minutes
Processing status
normalization gap

vendor-incident-hf

healthy

One historical May 31, 2024 Spaces disclosure. Not a current vendor-incident discovery feed.

Last successful fetch
Last complete checkpoint
Check interval / stale threshold
60 / 180 minutes
Processing status
complete

How to read a report

Source-listed means the report normalizes attributed upstream facts. It does not mean PRAE reproduced a vulnerability or reviewed a particular customer deployment. A reviewed label requires a recorded human review. Source disclosure, source update, PRAE’s first observation and PRAE’s publication dates are separate.

CVSS values retain their publisher and version. The displayed severity filter uses the first available attributed score under this order: CNA, GitHub, OSV, then NVD. It is not a blended risk score. EPSS is a dated probability estimate; percentile and probability are distinct. CISA catalog membership is evidence of catalog-listed exploitation, not a finding of compromise in your environment.

Historical first-fixed versions are useful context. They are not automatically current, supported upgrade targets. Publisher conditions and known fixes remain visible without a purchase.

Scope is not a clean bill of health

  • Public reports describe source-listed scope, not the applicability of an issue to your deployment.
  • The connected evaluator is a development preview. No software entitlement is included with the Field Kit.
  • Unsupported version semantics, incomplete coverage, missing facts and stale deployment evidence remain unknown.
  • GitHub, OSV, NVD and CVE records can mirror the same publisher assertion; multiple links are not independent corroboration.
  • Publisher prose and mixed-license OSV records remain private pending rights and editorial review.

Currently represented ecosystems: Go, Hex, Maven, NuGet, Pub, PyPI, RubyGems, SwiftURL, actions, composer, crates.io, erlang, go, maven, npm, nuget, php, pip, pub, rubygems, rust, swift, unknown. A missing ecosystem or report does not establish the absence of an issue.

Publication and rights

Structured facts are attributed to their original publishers. CISA KEV is CC0; CVE terms, GitHub’s CC-BY-4.0 attribution, NVD’s notice and FIRST’s security-use terms remain attached to their records. OSV combines publishers with different licenses; only the reviewed GHSA-origin scope is eligible for automatic publication here. PHP and other publisher-page candidates remain private until the specific source and proposed summary are reviewed.

CVE® content is copyright The MITRE Corporation and used under the CVE Terms of Use. GitHub Advisory Database content is licensed under CC BY 4.0; PRAE transforms and combines attributed fields. CISA KEV uses CC0 1.0. EPSS is subject to FIRST’s terms. Individual source links and dates remain on each report.

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Your environment stays separate

Reading a report does not upload inventory or create a private finding. Optional orientation answers stay in browser memory and disappear when you leave or reset the page. They are not sent to a server, stored in the URL or used to subscribe you to marketing. Public search uses a normal request URL; hosting access logs can contain that query.

The connected preview uses synthetic data. Connected software, licensing and any future price are separate from the educational Field Kit.

Privacy details · Report a source error or request a correction · Public coverage API