| identity: Does this identifier describe a vulnerability at all? first match wins |
|---|
| 1 |
rejected |
no-match |
|
CVE Program withdrawal of this identifier |
| scope: Is the vulnerability ARMR's to address? first match wins |
|---|
| 2 |
armr-patch-file |
no-match |
|
An ARMR patch file on disk for this CVE |
| 3 |
armr-secure-rule-file |
no-match |
|
An ARMR security-rule template on disk for this CVE |
| 4 |
manual-classification |
no-match |
|
A researcher's recorded decision for this specific CVE |
| 5 |
manual classification |
no-match |
|
Manual classification of this CVE in the legacy dataset |
| 6 |
non-java-upstream |
no-match |
|
A root cause in non-Java code: an OS kernel, a C library, or a bundled runtime |
| 7 |
oracle-component |
no-match |
|
The defect being in a component of a tracked product the agent does not reach: JavaFX, the Java SE installer, the native WebLogic proxy plug-in. Oracle gives these no CPE of their own and names them only in the description. |
| 8 |
osv-maven |
no-match |
|
An OSV.dev record of this CVE affecting a package published to Maven Central |
| 9 |
cna-maven-package |
no-match |
|
An affected Maven artifact named by the CNA itself |
| 10 |
known-cpe-product |
no-match |
|
An NVD CPE naming a product ARMR tracks |
| 11 |
cna-cpe-product |
no-match |
|
A CPE the CNA published naming a tracked product. Oracle publishes these on advisory day, months before NVD. |
| 12 |
oracle-advisory-family |
no-match |
|
A tracked product family named in Oracle's own risk matrix. CPE cannot carry a suite name, only a module. |
| 13 |
non-deployable-product |
no-match |
|
The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached |
| 14 |
unmatched-product decided it |
matched |
Not applicable |
No tracked product matched |
| disposition: What do we do about one that is? cumulative: every rule gets a turn |
|---|
| 15 |
patch-hint |
not-reached |
|
A reference pointing at the upstream fix: a commit, a PR, a Red Hat bug |
| 16 |
open-source-maven |
not-reached |
|
The affected package being open source on Maven, so the fix can be read |
| 17 |
poc-derivable |
not-reached |
|
An indexed exploit to reverse-engineer, where there is no source to read |
| 18 |
no-exploit |
not-reached |
|
With no fix path, a public exploit, or a CISA record of one |
| 19 |
secure-rule-match |
not-reached |
|
A vulnerability class already blocked by an ARMR security rule |
| 20 |
below-action-threshold |
not-reached |
|
Medium or Low severity, no KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory |
| 21 |
no-exploit-published |
not-reached |
|
A published working exploit for this candidate, not only a proof of concept, a forecast, or nothing at all |
VRT
391,810 CVEs tracked ·
15,472 in RASP scope ·
data as of 55 minutes ago