Advisory database
Advisories
Every vulnerability Maple Labs has found and disclosed, newest first. Each was reported privately to its vendor before it appeared here.
All advisories
No advisories published yet. Each one appears here after its vendor has had the chance to fix it.
Reading an advisory
What each field means.
- MLSA-YYYY-NNNN
- Our own identifier: a Maple Labs Security Advisory, numbered within its year. Every advisory has one, from the day it is published.
- CVE
- The industry-wide identifier, assigned by the vendor’s CVE Numbering Authority, or by MITRE’s when the vendor has none. Maple Labs is not a CNA and never assigns one itself. “Pending” means it has been requested.
- Severity
- The CVSS base score, with its vector, in CVSS 3.1 or 4.0. Critical is 9.0 and above, high 7.0–8.9, medium 4.0–6.9, low 0.1–3.9.
- Fixed in
- The first version without the vulnerability. “No fix when published” means the disclosure deadline passed first.
- Timeline
- When we reported it, when the vendor answered, and when it was fixed and published.
- advisories.json
- The same database as JSON, for feeds and scanners. Each entry carries every field on its page.