Skip to content
THREATWIRE

Desk

Editorial policy

How ThreatWire sources, labels and corrects what it publishes.

Sources

The desk checks the vendor advisory first, then NVD, then the CISA Known Exploited Vulnerabilities (KEV) catalogue. Researcher write-ups and news outlets are used as references and are named as such. A post on social media is a lead, not a source.

Confirmed and unconfirmed

  • Facts that a primary source states are written as facts, with the source listed.
  • Claims that come only from a researcher, a news outlet or a rumour are attributed to them and labelled as not confirmed by the vendor.
  • Unknown is a valid state. A missing score, version or exploitation status is shown as unknown and is never filled in by guesswork.
  • When sources disagree, the page says so and shows both versions.

Labels on CVE records

  • CVSS is a score published by the vendor or NVD, with the scorer named. ThreatWire does not score vulnerabilities itself.
  • KEV means the CVE is in the CISA KEV catalogue at the time of writing.
  • EPSS is the FIRST estimate of the chance of exploitation in the next 30 days. It is a probability, not a confirmation.
  • PoC means a public proof-of-concept reference exists. It records that a reference exists. It is not a statement that ThreatWire tested it.
  • Exploit and Active exploitation are used only when a primary source or a trusted report confirms them. Active exploitation is not inferred from a link or a rumour.
  • 0-day is used only when exploitation was confirmed before a fix existed.

What ThreatWire does not publish

ThreatWire does not publish exploit code, payloads or step-by-step attack instructions. Links to third-party research are references and are labelled unverified.

Dates and updates

Every article and record shows a published date and, when it changed, an updated date. Drafts are not public. Records can change as vendors and NVD update their data.

Corrections

If a record or article is wrong, tell the desk through the contact page. Name the page and the claim, and include a primary source if you have one. A confirmed error is fixed in the page and the updated date changes. A material correction is stated in the text.

Who publishes

Articles and records carry the ThreatWire Desk byline.