A BDVDB entry is built to answer two questions quickly: does this affect me, and what should I do about it? This guide explains where to find those answers.
The heading
The heading shows two identifiers. The CVE ID is the global identifier assigned through the CVE Program. The BDVDB ID is our own, and it also exists for issues that do not have a CVE yet. Use either one when you talk to a vendor or search for more information.
The main column
Description and impact
The description states what is wrong. Where a record comes from an upstream source, the description is copied without changes. The impact section says which security properties are affected.
Weaknesses
Each weakness links to a CWE entry, which describes the general class of mistake. CWE is useful for developers who want to stop the same kind of bug from coming back.
References and exploits
References lead to advisories, patches and analysis. Go to the vendor’s advisory first. The Exploit section lists links that upstream sources have tagged as exploit material. If the section says no public exploit is known, that only means none is recorded. It does not prove that none exists.
The sidebar
Scores
The score panel shows one CVSS base score and its severity. If a record has more than one CVSS version, the Scoring System panel shows each in its own tab, with the full vector and every metric.
EPSS and KEV
EPSS estimates how likely exploitation is in the next 30 days. KEV says whether CISA has listed the issue as exploited in the wild. Our guide to scoring explains how to use them together.
Affected systems
This panel lists vulnerable and fixed versions. When a fixed version says “Not stated”, the source did not record one, so check the vendor’s advisory.