Review your closed tickets

Check the CVEs you closed

Paste what you closed. This compares each line against the record as it reads now.

A ticket export, a spreadsheet column or a plain list all work. Each CVE has a public record naming the affected products and the version that fixes them.

An answer you can inspect.

The earlier statement and what replaced it
Source commits behind each finding
A saved review or feed for your next check

Privacy & sharing Data & methodology

A finding says the record changed, not that you are vulnerable. What reaches you depends on what you actually run.

What every ID is checked for

Four short names below: CVSS is the 0 to 10 severity score a record carries, and the bands it is read in, Low through Critical. CISA is the US Cybersecurity and Infrastructure Security Agency, and KEV is its list of the flaws it knows are being exploited. GHSA is the id GitHub gives an advisory in its own database.

Two of these name a version — the first fixed version and the last affected one — so only those can be compared against what you patched to, and only within one release line, the same numbered branch of a product. The rest report what changed and give no verdict.

CVE catalog

Counted in CVE records

Fix version moved: The record states a higher fix boundary on the same release branch. This does not establish that the earlier fix failed.
Affected range extended: The record states a higher last affected version on the same release branch.
Product added: The record names an affected product absent from its initial listing.
CVSS base score changed: The published maximum base score changed on the same CVSS version and assessment context. This measures a record revision, not exposure.
Record state changed: The CVE record changed publication state.

CISA KEV

Counted in CVE records

Added to CISA KEV: CISA added the CVE to its Known Exploited Vulnerabilities catalog.
Ransomware use confirmed: CISA changed its known ransomware campaign use field from Unknown to Known.
Forensic triage now required: CISA added a forensic triage requirement to the entry.
KEV required action changed: CISA revised the required action text.
KEV due date moved: CISA revised the remediation due date.
Removed from CISA KEV: CISA removed the CVE from its catalog.

GitHub advisories

Counted in advisories, a different unit from CVE records and never added to them

Advisory fix version moved: The advisory states a higher fixed version for the same package and release branch.
Package added to advisory: The advisory added an affected package.
Advisory severity changed: The advisory changed its published severity label. The evidence identifies whether its scoring vector also changed.
Advisory withdrawn: The advisory now carries a withdrawal timestamp.

Data sources and quality

Not checked: a record published before 2023 cannot be read back as published, so it comes back unchecked, never clear. KEV checks see only what moved from 2025-01-27 on, so a long-standing entry like Log4Shell shows no match. That is the window we can see, not a finding.

Not checked: a GitHub advisory is the GHSA entry a Dependabot alert links to, and it is reached here only through the CVE IDs it names. That is a lookup, not an identity: an advisory can name several CVEs or none, and only the advisories GitHub reviews are compared. An empty advisory result is a statement about that source, not about the packages you depend on.

Not counted: changes this run filtered as likely false positives are shown beside the check that produced them, marked, and counted in no figure here. A filtered change is not an all-clear either.

How this is measured, in full →

Shipped snapshot computed 2026-09-07 from catalog commit 1f78fd2580c1. Real findings, not live ones: records amended since are not reflected. A later fix version is evidence that the record changed, not evidence that the first fix was incomplete.