Software security glossary
The vulnerability-management terms that actually matter — in plain English · 638 products tracked · 431 CVEs actively exploited now · updated August 2026
Every term below is a quick definition with a deeper guide behind it. Together they answer the real question: which vulnerabilities should I fix first, and is the software I run affected? CVSS says how severe, EPSS says how likely, and KEV says what's being exploited right now.
The unique public ID for one specific vulnerability — the shared name the whole industry uses.
Read the guide →A 0–10 severity score: how bad a flaw is, in theory. 9.0+ is Critical.
Read the guide →CISA's list of vulnerabilities being actively exploited right now — the fix-first signal.
Read the guide →A 0–100% probability a vulnerability will be exploited in the next 30 days.
Read the guide →A decision framework — Track / Attend / Act — that prioritises by exploitation and your context.
Read the guide →A machine-readable list of every component inside a piece of software.
Read the guide →A statement of which vulnerabilities in your components actually affect you, and why.
Read the guide →A release the vendor no longer supports — so it stops getting security patches.
Read the guide →The protocol that encrypts HTTPS traffic. SSL and TLS 1.0/1.1 are deprecated — and its worst CVEs (Heartbleed) live in the library, not the protocol.
Read the guide →Agentic AI security
As teams ship autonomous AI agents, a new set of terms describes risks that don't apply to static software — agents that can plan, call tools, hold memory and act on their own. Read the guide or score your agents free →
An OWASP 0–10 score that extends CVSS with ten agent-specific amplification factors.
Read the guide →Private data + untrusted content + external comms — the combination that lets an agent leak secrets.
Read the guide →The ten most critical security risks specific to autonomous AI agents.
Read the guide →Forensics & operational security
Terms beyond the CVE pipeline — the artifacts and habits that decide what your systems leak, and what an investigator (or attacker) can recover after the fact.
A consistent set of recommended security settings (Microsoft, CIS, STIG) applied to every device to shrink the attack surface.
Read the guide →Windows caches 64×64 tiles of your remote sessions to disk — a forensic trail (and data leak) that outlives the session.
Read the guide →How they fit together
A CVE names a vulnerability. CVSS rates its severity, EPSS predicts its exploitation, and KEV confirms it's being exploited. SSVC turns those signals plus your context into a Track / Attend / Act decision. An SBOM lists your components, a VEX says which of their vulnerabilities actually affect you, and end-of-life dates tell you when patches stop coming. IsItPatched combines them into one verdict — see the methodology.
Check your own software
- Check a version — paste a product + version for an instant verdict.
- Scan an SBOM — a fix-first patch queue for every component, in your browser.
- Actively exploited CVEs — the 431 KEV flaws affecting tracked software.