> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-b/05-5-practical-priority-hierarchy-for-ingestion.md).

# 5. Practical priority hierarchy for ingestion

## 5.1 Tier 0 - identifiers & inventory

<table><thead><tr><th width="88.5546875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>SBOM</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cyclonedx.org/specification/overview/">cyclonedx.org/specification/overview</a>, <a href="https://spdx.dev/specifications/">spdx.dev/specifications</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open standards</td><td><strong><code>Relevance</code>:</strong> Inventory foundation for matching components to vulnerabilities.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Without accurate inventory, vulnerability matching is incomplete or noisy.</td></tr><tr><td align="right">2</td><td><strong>Package identity</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://csrc.nist.gov/projects/software-identification-swid">csrc.nist.gov/projects/software-identification-swid</a>, <a href="https://github.com/package-url/purl-spec">github.com/package-url/purl-spec</a>, <a href="https://nvd.nist.gov/products/cpe">nvd.nist.gov/products/cpe</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open standards</td><td><strong><code>Relevance</code>:</strong> Component identity across package, product, &#x26; installed software domains.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use PURL for packages, CPE for products/platforms, SWID for installed software identity.</td></tr><tr><td align="right">3</td><td><strong>Asset exposure</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://search.censys.io/">search.censys.io</a>, <a href="https://www.shodan.io/">www.shodan.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free tiers / paid plans</td><td><strong><code>Relevance</code>:</strong> Determines whether vulnerable assets are externally reachable.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Combine with internal CMDB, cloud inventory, &#x26; authenticated scans.</td></tr><tr><td align="right">4</td><td><strong>Artifact provenance</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://in-toto.io/">in-toto.io</a>, <a href="https://slsa.dev/">slsa.dev</a>, <a href="https://www.sigstore.dev/">www.sigstore.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source / open standards</td><td><strong><code>Relevance</code>:</strong> Validates build-chain integrity &#x26; artifact authenticity.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Helps distinguish vulnerable dependency risk from supply-chain tampering risk.</td></tr></tbody></table>

## 5.2 Tier 1 - canonical vulnerability records

<table><thead><tr><th width="87.2734375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVE List v5</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cvelistV5">github.com/CVEProject/cvelistV5</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Canonical CVE record mirror.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Core identity source.</td></tr><tr><td align="right">2</td><td><strong>CVE schema</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cve-schema">github.com/CVEProject/cve-schema</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Schema validation for CVE records.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use for parser correctness.</td></tr><tr><td align="right">3</td><td><strong>CVE Services API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cveawg.mitre.org/api-docs/">cveawg.mitre.org/api-docs</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs; CNA functions may require role/account</td><td><strong><code>Relevance</code>:</strong> Direct programmatic CVE lookup.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for targeted CVE access.</td></tr><tr><td align="right">4</td><td><strong>NVD CVE API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/developers/vulnerabilities">nvd.nist.gov/developers/vulnerabilities</a><br><br><strong><code>Access / Cost</code>:</strong> Free public; optional free API key for higher rate limits</td><td><strong><code>Relevance</code>:</strong> CVSS/CPE/CWE/reference enrichment.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Core enrichment source.</td></tr><tr><td align="right">5</td><td><strong>NVD CPE API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/developers/products">nvd.nist.gov/developers/products</a><br><br><strong><code>Access / Cost</code>:</strong> Free public; optional free API key for higher rate limits</td><td><strong><code>Relevance</code>:</strong> CPE dictionary &#x26; product matching.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for product-level mapping.</td></tr><tr><td align="right">6</td><td><strong>NVD data feeds</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/vuln/data-feeds">nvd.nist.gov/vuln/data-feeds</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Bulk NVD feed access.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for bootstrapping.</td></tr><tr><td align="right">7</td><td><strong>CISA Vulnrichment</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/cisagov/vulnrichment">github.com/cisagov/vulnrichment</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> CISA ADP enrichment &#x26; SSVC data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Prioritization enrichment.</td></tr></tbody></table>

## 5.3 Tier 2 - package/ecosystem vulnerability records

<table><thead><tr><th width="89.515625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>OSV full database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/osv.dev/data/#full-database-download">google.github.io/osv.dev/data/#full-database-download</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Local mirror of OSS vulnerability records.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Best for high-volume package matching.</td></tr><tr><td align="right">2</td><td><strong>OSV API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/osv.dev/post-v1-query/">google.github.io/osv.dev/post-v1-query</a><br><br><strong><code>Access / Cost</code>:</strong> Free public API</td><td><strong><code>Relevance</code>:</strong> Online vulnerability lookup by package/version/commit/ID.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for targeted lookups.</td></tr><tr><td align="right">3</td><td><strong>GitHub Advisory Database</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/advisories">github.com/advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> GHSA/CVE/malware advisory records.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Preserve aliases.</td></tr><tr><td align="right">4</td><td><strong>GitHub Advisory Database repo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/github/advisory-database">github.com/github/advisory-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Raw advisory data for local ingestion.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for mirroring.</td></tr><tr><td align="right">5</td><td><strong>Go vuln DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://vuln.go.dev/">vuln.go.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Official Go vulnerability database.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Go- specific affectedness.</td></tr><tr><td align="right">6</td><td><strong>RustSec</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rustsec.org/">rustsec.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source ecosystem</td><td><strong><code>Relevance</code>:</strong> Rust advisory ecosystem.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Rust crate-specific advisories.</td></tr><tr><td align="right">7</td><td><strong>PyPA advisory DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/pypa/advisory-database">github.com/pypa/advisory-database</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Python advisory source.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Python/PyPI coverage.</td></tr><tr><td align="right">8</td><td><strong>FriendsOfPHP</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/FriendsOfPHP/security-advisories">github.com/FriendsOfPHP/security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> PHP Composer advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Composer-specific.</td></tr><tr><td align="right">9</td><td><strong>RubySec</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/rubysec/ruby-advisory-db">github.com/rubysec/ruby-advisory-db</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> RubyGems advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Ruby ecosystem.</td></tr><tr><td align="right">10</td><td><strong>OSS Index</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://ossindex.sonatype.org/">ossindex.sonatype.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / API terms; commercial Sonatype products separate</td><td><strong><code>Relevance</code>:</strong> Package vulnerability intelligence.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Secondary enrichment.</td></tr><tr><td align="right">11</td><td><strong>Packagist API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packagist.org/apidoc#list-security-advisories">packagist.org/apidoc#list-security-advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free public API docs / public API</td><td><strong><code>Relevance</code>:</strong> Composer advisory API.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Direct PHP ecosystem source.</td></tr></tbody></table>

## 5.4 Tier 3 - affectedness, distro & vendor truth

<table><thead><tr><th width="91.0234375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Red Hat Security Data</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data; support content may require subscription</td><td><strong><code>Relevance</code>:</strong> RHEL affectedness, CSAF/VEX, OSV, OVAL.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Backport-aware.</td></tr><tr><td align="right">2</td><td><strong>Debian Security Tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://security-tracker.debian.org/">security-tracker.debian.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Debian package affectedness.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Backport-aware.</td></tr><tr><td align="right">3</td><td><strong>Ubuntu OVAL / OSV / OpenVEX</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/canonical/ubuntu-security-notices">github.com/canonical/ubuntu-security-notices</a>, <a href="https://ubuntu.com/security/oval">ubuntu.com/security/oval</a>, <a href="https://ubuntu.com/security/vex">ubuntu.com/security/vex</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Ubuntu package affectedness &#x26; VEX status.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use release-specific data.</td></tr><tr><td align="right">4</td><td><strong>Alpine SecDB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://secdb.alpinelinux.org/">secdb.alpinelinux.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Alpine package vulnerability data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Container-critical.</td></tr><tr><td align="right">5</td><td><strong>SUSE CSAF / OVAL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.suse.com/support/security/csaf/">www.suse.com/support/security/csaf</a>, <a href="https://www.suse.com/support/security/oval/">www.suse.com/support/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> SUSE vendor affectedness &#x26; scanner data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use machine-readable formats where possible.</td></tr><tr><td align="right">6</td><td><strong>Oracle Linux OVAL / errata</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://linux.oracle.com/errata/">linux.oracle.com/errata</a>, <a href="https://linux.oracle.com/security/oval/">linux.oracle.com/security/oval</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Oracle Linux patch &#x26; OVAL data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Oracle Linux-specific.</td></tr><tr><td align="right">7</td><td><strong>Amazon Linux ALAS</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://alas.aws.amazon.com/">alas.aws.amazon.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Amazon Linux advisories.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Separate AL2 &#x26; AL2023.</td></tr><tr><td align="right">8</td><td><strong>AlmaLinux / Rocky / Fedora / Arch / Gentoo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://bodhi.fedoraproject.org/updates/?type=security">bodhi.fedoraproject.org/updates/?type=security</a>, <a href="https://errata.almalinux.org/">errata.almalinux.org</a>, <a href="https://errata.build.resf.org/">errata.build.resf.org</a>, <a href="https://security.archlinux.org/">security.archlinux.org</a>, <a href="https://security.gentoo.org/glsa/">security.gentoo.org/glsa</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Additional Linux distribution affectedness sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Distro semantics vary substantially.</td></tr><tr><td align="right">9</td><td><strong>Wolfi / Chainguard</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/wolfi-dev/advisories">github.com/wolfi-dev/advisories</a>, <a href="https://packages.cgr.dev/chainguard/security.json">packages.cgr.dev/chainguard/security.json</a>, <a href="https://packages.wolfi.dev/os/security.json">packages.wolfi.dev/os/security.json</a><br><br><strong><code>Access / Cost</code>:</strong> Wolfi free public; Chainguard feed may relate to commercial product scope</td><td><strong><code>Relevance</code>:</strong> Container-first package vulnerability feeds.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for minimal images.</td></tr><tr><td align="right">10</td><td><strong>Vendor advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://helpx.adobe.com/security.html">helpx.adobe.com/security.html</a>, <a href="https://msrc.microsoft.com/update-guide">msrc.microsoft.com/update-guide</a>, <a href="https://security.paloaltonetworks.com/">security.paloaltonetworks.com</a>, <a href="https://sec.cloudapps.cisco.com/security/center/publicationListing.x">sec.cloudapps.cisco.com/security/center/publicationListing.x</a>, <a href="https://support.apple.com/en-us/100100">support.apple.com/en-us/100100</a>, <a href="https://support.broadcom.com/web/ecx/security-advisory">support.broadcom.com/web/ecx/security-advisory</a>, <a href="https://support.citrix.com/securitybulletins">support.citrix.com/securitybulletins</a>, <a href="https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html">support.sap.com/en/my-support/knowledge-base/security-notes- news.html</a>, <a href="https://www.atlassian.com/trust/security/advisories">www.atlassian.com/trust/security/advisories</a>, <a href="https://www.fortiguard.com/psirt">www.fortiguard.com/psirt</a>, <a href="https://forums.ivanti.com/s/security-advisory">forums.ivanti.com/s/security-advisory</a>, <a href="https://www.oracle.com/security-alerts/">www.oracle.com/security-alerts</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public advisories; some vendors require support accounts/subscriptions for full details or downloads</td><td><strong><code>Relevance</code>:</strong> Vendor truth for affected products, fixed versions, mitigations, &#x26; exploitation notes.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Often most authoritative for product affectedness. Access, formatting, &#x26; update latency vary.</td></tr></tbody></table>

## 5.5 Tier 4 - severity & prioritization

<table><thead><tr><th width="88.19140625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVSS v3.1/v4.0</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.first.org/cvss/v3.1/specification-document">www.first.org/cvss/v3.1/specification-document</a>, <a href="https://www.first.org/cvss/v4.0/specification-document">www.first.org/cvss/v4.0/specification-document</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Standard severity scoring.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Severity is not exploit likelihood.</td></tr><tr><td align="right">2</td><td><strong>EPSS</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.first.org/epss/">www.first.org/epss</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data/API</td><td><strong><code>Relevance</code>:</strong> Exploit likelihood prediction.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Temporal; store score date.</td></tr><tr><td align="right">3</td><td><strong>KEV</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json">www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public feed</td><td><strong><code>Relevance</code>:</strong> Known exploited vulnerability signal.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong but incomplete exploited-in-the-wild signal.</td></tr><tr><td align="right">4</td><td><strong>SSVC</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CERTCC/SSVC">github.com/CERTCC/SSVC</a>, <a href="https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc">www.cisa.gov/stakeholder-specific- vulnerability-categorization-ssvc</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source</td><td><strong><code>Relevance</code>:</strong> Decision support for remediation urgency.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Requires environmental/mission context.</td></tr><tr><td align="right">5</td><td><strong>CISA Vulnrichment</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/cisagov/vulnrichment">github.com/cisagov/vulnrichment</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> SSVC &#x26; enrichment data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Coverage varies.</td></tr><tr><td align="right">6</td><td><strong>Vendor exploited-in-the-wild flags</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://msrc.microsoft.com/update-guide">msrc.microsoft.com/update-guide</a>, <a href="https://support.apple.com/en-us/100100">support.apple.com/en-us/100100</a>, <a href="https://www.oracle.com/security-alerts/">www.oracle.com/security- alerts</a><br><br><strong><code>Access / Cost</code>:</strong> Free public, though product support details may vary</td><td><strong><code>Relevance</code>:</strong> Vendor- provided exploitation status.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Often product-specific &#x26; time-sensitive.</td></tr><tr><td align="right">7</td><td><strong>Patch availability &#x26; fixed-version feeds</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://access.redhat.com/security/data">access.redhat.com/security/data</a>, <a href="https://github.com/canonical/ubuntu-security-notices">github.com/canonical/ubuntu-security-notices</a>, <a href="https://security-tracker.debian.org/tracker/data/json">security-tracker.debian.org/tracker/data/json</a><br><br><strong><code>Access / Cost</code>:</strong> Free public data; some vendor support may require subscription</td><td><strong><code>Relevance</code>:</strong> Determines whether remediation exists.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Patch availability varies by distro/release/product.</td></tr><tr><td align="right">8</td><td><strong>Environmental context</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.greynoise.io/">docs.greynoise.io</a>, <a href="https://search.censys.io/">search.censys.io</a>, <a href="https://www.shodan.io/">www.shodan.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free tiers / paid plans</td><td><strong><code>Relevance</code>:</strong> Internet exposure, asset criticality, privilege boundary, &#x26; data sensitivity determine real impact.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Must be joined with internal asset inventory &#x26; controls.</td></tr></tbody></table>

## 5.6 Tier 5 - exploitability & weaponization

<table><thead><tr><th width="85.94140625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>Exploit-DB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.exploit-db.com/">www.exploit-db.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Public exploit availability.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Verify target versions &#x26; exploit reliability.</td></tr><tr><td align="right">2</td><td><strong>Metasploit modules</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits">github.com/rapid7/metasploit-framework/tree/master/modules/exploits</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Weaponized exploit modules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong operationalization signal.</td></tr><tr><td align="right">3</td><td><strong>Packet Storm</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://packetstormsecurity.com/files/tags/exploit/">packetstormsecurity.com/files/tags/exploit</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Exploit archive.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Metadata quality varies.</td></tr><tr><td align="right">4</td><td><strong>Project Zero</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://projectzero.google/">projectzero.google</a>, <a href="https://project-zero.issues.chromium.org/issues">project- zero.issues.chromium.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public; some issues may be restricted pre-disclosure</td><td><strong><code>Relevance</code>:</strong> Root-cause &#x26; exploitability research.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> High-quality technical details.</td></tr><tr><td align="right">5</td><td><strong>CERT/CC VU notes</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.kb.cert.org/vuls/">www.kb.cert.org/vuls</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Coordinated disclosure &#x26; affected vendor context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for ecosystem-wide vulns.</td></tr><tr><td align="right">6</td><td><strong>Rapid7 AttackerKB</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://attackerkb.com/">attackerkb.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public content; commercial Rapid7 offerings separate</td><td><strong><code>Relevance</code>:</strong> Attacker value &#x26; exploitability context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Secondary enrichment.</td></tr><tr><td align="right">7</td><td><strong>GreyNoise</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://docs.greynoise.io/">docs.greynoise.io</a>, <a href="https://viz.greynoise.io/">viz.greynoise.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / paid plans</td><td><strong><code>Relevance</code>:</strong> Internet exploitation/scanning telemetry.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Distinguishes noise from activity.</td></tr><tr><td align="right">8</td><td><strong>Shadowserver</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://dashboard.shadowserver.org/">dashboard.shadowserver.org</a>, <a href="https://www.shadowserver.org/">www.shadowserver.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free for eligible organizations; registration may be required</td><td><strong><code>Relevance</code>:</strong> Exposure &#x26; threat telemetry.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Access &#x26; reporting terms vary.</td></tr><tr><td align="right">9</td><td><strong>Nuclei templates</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/projectdiscovery/nuclei-templates">github.com/projectdiscovery/nuclei-templates</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Detection templates for exposed vulnerabilities.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Template presence is not proof of exposure.</td></tr><tr><td align="right">10</td><td><strong>Vendor emergency advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cisa.gov/cybersecurity-advisories">www.cisa.gov/cybersecurity-advisories</a>, <a href="https://www.fortiguard.com/psirt">www.fortiguard.com/psirt</a>, <a href="https://forums.ivanti.com/s/security-advisory">forums.ivanti.com/s/security-advisory</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Emergency/active exploitation guidance.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Highly time-sensitive; monitor frequently.</td></tr></tbody></table>

## 5.7 Tier 6 - weakness, attack-pattern & AI context

<table><thead><tr><th width="91.34765625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CWE</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cwe.mitre.org/">cwe.mitre.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Weakness taxonomy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> CVE-to-CWE mappings can be broad or missing.</td></tr><tr><td align="right">2</td><td><strong>CAPEC</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://capec.mitre.org/">capec.mitre.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Attack-pattern taxonomy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Maps weaknesses to attack patterns.</td></tr><tr><td align="right">3</td><td><strong>ATT&#x26;CK Enterprise</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://attack.mitre.org/matrices/enterprise/">attack.mitre.org/matrices/enterprise</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Enterprise adversary behavior taxonomy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> More post-exploitation than CVE-specific.</td></tr><tr><td align="right">4</td><td><strong>ATT&#x26;CK STIX</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/mitre-attack/attack-stix-data">github.com/mitre-attack/attack-stix-data</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Machine-readable ATT&#x26;CK data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Best for ingestion.</td></tr><tr><td align="right">5</td><td><strong>MITRE CTI repo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/mitre/cti">github.com/mitre/cti</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> MITRE STIX data repository.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for CTI graphing.</td></tr><tr><td align="right">6</td><td><strong>MITRE ATLAS</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://atlas.mitre.org/">atlas.mitre.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> AI adversary tactics &#x26; techniques.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Directly relevant to AI/ML systems.</td></tr><tr><td align="right">7</td><td><strong>OWASP LLM Top 10</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://owasp.org/www-project-top-10-for-large-language-model-applications/">owasp.org/www-project-top-10-for-large-language-model-applications</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open community</td><td><strong><code>Relevance</code>:</strong> LLM application vulnerability taxonomy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for AI appsec.</td></tr><tr><td align="right">8</td><td><strong>OWASP ML Security Top 10</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://owasp.org/www-project-machine-learning-security-top-10/">owasp.org/www-project-machine-learning-security-top-10</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open community</td><td><strong><code>Relevance</code>:</strong> ML security risk taxonomy.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Complements ATLAS.</td></tr><tr><td align="right">9</td><td><strong>NIST AI RMF &#x26; NIST AI 600-1</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf">nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf</a>, <a href="https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence">www.nist.gov/publications/artificial-intelligence-risk- management-framework-generative-artificial-intelligence</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> AI risk management &#x26; GenAI risk profile.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Governance/risk context, not vuln feed.</td></tr></tbody></table>

## 5.8 Tier 7 - detection engineering & validation

<table><thead><tr><th width="91.6328125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CodeQL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://codeql.github.com/">codeql.github.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free for many open-source uses; commercial GitHub Advanced Security for many enterprise/private workflows</td><td><strong><code>Relevance</code>:</strong> Semantic code vulnerability detection.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong for variant analysis.</td></tr><tr><td align="right">2</td><td><strong>Semgrep</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://semgrep.dev/">semgrep.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free/open-source CLI; commercial products available</td><td><strong><code>Relevance</code>:</strong> Pattern-based static analysis.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Fast custom rules.</td></tr><tr><td align="right">3</td><td><strong>Joern</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://joern.io/">joern.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Code property graph analysis.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for research &#x26; advanced detection.</td></tr><tr><td align="right">4</td><td><strong>Infer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://fbinfer.com/">fbinfer.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Static analysis engine.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for specific bug classes.</td></tr><tr><td align="right">5</td><td><strong>Sonar rules</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rules.sonarsource.com/">rules.sonarsource.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public catalog; commercial Sonar products available</td><td><strong><code>Relevance</code>:</strong> Security/code quality rule catalog.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for rule taxonomy mapping.</td></tr><tr><td align="right">6</td><td><strong>Nuclei templates</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/projectdiscovery/nuclei-templates">github.com/projectdiscovery/nuclei-templates</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> DAST/exposure templates.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Template quality varies.</td></tr><tr><td align="right">7</td><td><strong>OSS-Fuzz</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/oss-fuzz/">google.github.io/oss-fuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free for eligible open-source projects</td><td><strong><code>Relevance</code>:</strong> Continuous fuzzing.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for discovery &#x26; OSV-linked vulns.</td></tr><tr><td align="right">8</td><td><strong>SARD / Juliet</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://samate.nist.gov/SARD/">samate.nist.gov/SARD</a>, <a href="https://samate.nist.gov/SARD/test-suites/112">samate.nist.gov/SARD/test- suites/112</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Test suites for vulnerability detection.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for evaluation; not production vulnerability feed.</td></tr><tr><td align="right">9</td><td><strong>Vulnerability datasets</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/DLVulDet/PrimeVul">github.com/DLVulDet/PrimeVul</a>, <a href="https://github.com/Icyrockton/MegaVul">github.com/Icyrockton/MegaVul</a>, <a href="https://github.com/ZeoVan/MSR_20_Code_vulnerability_CSV_Dataset">github.com/ZeoVan/MSR_20_Code_vulnerability_CSV_Dataset</a>, <a href="https://github.com/secureIT-project/CVEfixes">github.com/secureIT-project/CVEfixes</a>, <a href="https://github.com/tuhh-softsec/vul4j">github.com/tuhh-softsec/vul4j</a>, <a href="https://github.com/wagner-group/diversevul">github.com/wagner-group/diversevul</a>, <a href="https://sites.google.com/view/devign">sites.google.com/view/devign</a><br><br><strong><code>Access / Cost</code>:</strong> Mostly free public research datasets; verify license individually</td><td><strong><code>Relevance</code>:</strong> ML/research datasets for vulnerability detection.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate labels, leakage, deduplication, &#x26; licensing.</td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-b/05-5-practical-priority-hierarchy-for-ingestion.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.