Sources and licences
Every value on Threatist comes from a public source. These are the sources, what we take from each, and their terms.
| Source | What we take | Terms | Updated |
|---|---|---|---|
| CVE List V5 (CVE Program) | CVE records: titles, descriptions, affected products, references, CNA and CISA ADP scores, SSVC decision points | CVE Program terms of use | about every 10 minutes |
| National Vulnerability Database (NVD) | NVD CVSS scores, CWE and CPE configurations. This product uses the NVD API but is not endorsed or certified by the NVD. | NVD terms of use | about every 2 hours |
| CISA Known Exploited Vulnerabilities | Known exploited entries: date added, required action, due date | Public information from the U.S. government | about every 4 hours |
| FIRST Exploit Prediction Scoring System (EPSS) | Daily EPSS scores and percentiles | FIRST EPSS usage and citation | daily |
| GitHub Advisory Database | Advisories: affected packages, version ranges, fixed versions, references; aliases of unreviewed advisories. Threatist combines the advisories with the other sources and normalizes them. | CC BY 4.0 | about every hour |
| Red Hat security data (CSAF advisories and VEX) | Red Hat Security Advisories (RHSA): fixed packages per product; VEX: Red Hat's status per product (fixed, affected and its plan, not affected), Red Hat's rating and CVSS. Threatist summarizes them per product stream. | CC BY 4.0 | about every 6 hours |
| Microsoft Security Response Center (CSAF) | Microsoft's CVEs: updates (KB) with the fixed build per product, and Microsoft's assessment: exploited, publicly disclosed, exploitability. Microsoft's statement that a CVE was exploited is shown as Microsoft's; only CISA sets the KEV flag. | Public (TLP:WHITE), provided as is by Microsoft | about every 6 hours |
| MITRE CWE | Names of weaknesses, categories and views (CWE ids come from the CVE records and NVD) | CWE terms of use | monthly |