Hatena
Getting Software Vulnerability Information Early - CVE, CISA KEV, JPCERT/CC, OSV | npaka
SecurityFirst seen 223 points
This article is a beginner's guide to finding software security holes (vulnerabilities) early. It explains four main information sources: CVE, CISA KEV, JPCERT/CC, and OSV.
What the article covers
Software bugs that hackers can abuse are called vulnerabilities. The article explains how news about them spreads around the world. It then introduces four free sources where you can check for new ones and how to use them. It also covers a scoring system called CVSS that rates how serious a vulnerability is.
How vulnerability news spreads
First, a security researcher finds a flaw. They report it to the company that made the software. The company studies the problem and prepares a fix. Then the company publishes the news and the fix or a workaround. Security groups and databases then share the news widely. Sometimes the news comes out before a fix is ready, or a flaw is found only after attacks have already happened. A common world-wide ID number called CVE is used to name each flaw.
Four main sources
- CVE: a world-wide ID list for vulnerabilities. Its data is updated about every 7 minutes.
- CISA KEV: a list of flaws that attackers have really used. It is run by the US cyber security agency CISA.
- JPCERT/CC: a Japanese group that posts warnings and fix information in Japanese. It offers RSS feeds.
- OSV: a database of flaws in open-source software. It covers libraries for npm, PyPI, Maven, and crates.io.
Why it matters
A security hole that is known and not fixed can let people break into systems or leak data. Checking these sources early helps you fix the most urgent problems first. The article also says that a severity score alone is not enough. You should also check whether attacks are happening and whether your own systems are affected.
Tips to act early
- Watch the CVE, CISA KEV, JPCERT/CC, and OSV sources for the whole world.
- Follow the official Security Advisory pages of the products you use, such as your OS, servers, cloud, and network devices.
- Use APIs, RSS, or JSON to get updates automatically instead of checking by hand.
- Compare new flaws with the software versions you run, and send alerts when a match is found.
- Use CVSS scores (0.0 to 10.0) together with CISA KEV to decide what to fix first.
Glossary
- CVE
- A world-wide system that gives each software flaw its own ID number, such as CVE-2026-12345.
- CISA KEV
- A list from the US agency CISA of flaws that attackers have already used.
- JPCERT/CC
- A Japanese organization that collects cyber security information and shares warnings in Japanese.
- OSV
- A database of security flaws in open-source software libraries.
- CVSS
- A common scoring system from 0.0 to 10.0 that shows how serious a vulnerability is.
- Security Advisory
- An official security notice that a software maker publishes about its own products.