how-to · Security Open this in the console

Read a vulnerability finding.

A vulnerability finding means a program on the machine matches a published flaw. Each one says how sure we are, which version fixes it (or that none exists yet), and links every flaw to its public record.

Confirmed: the security advisory of the machine's own operating system lists this exact package build as affected. Likely: software installed outside the package manager (for example a PHP or Python copied in by hand), matched by its version number. Possible: a Windows program matched by its name only. A possible match never raises the severity on its own and does not count in the score. A flaw with no fix out yet is listed and counted, but lowers the score only when it is critical (actively exploited, or in a service open to the network): there is nothing to install until the fix arrives.

Find the vulnerability findings

Open Security. A vulnerability finding shows a confidence chip, the program and version, the version that fixes it (or no fix yet, or check the vendor when the record names no fixed version), and each flaw as a link to its public record. If not handled says what leaving it can cost.

Security page with a vulnerability finding showing confidence, fixed version and a flaw link — Example Co: openssl is behind its fixed version, with the flaw linked.

Why a newer-looking version can still be safe. Linux distributions often fix a flaw without changing the version number. A package that looks old can already be patched. So for software that came from the distribution, we trust the distribution's own advisories and not the version number alone.

Flaw links. Each flaw id opens its public record (OSV for distribution advisories, NVD for CVE ids). A KEV marker means the flaw is known to be used in real attacks (CISA's list). exposed means the program listens for connections from the network. no fix yet means no fixed version has been published; accept the finding with a reason, or limit access to the program. check the vendor for a newer version means the flaw's record names only the last affected version: a newer release usually fixes it.

Out of date. The flaw lists are refreshed daily from public sources (OSV, CISA KEV and NVD). If they have not refreshed for 3 days the Security page says vulnerability data out of date: new flaws may be missing until it refreshes. Nothing needs doing on the machines.

Reading the page: Read the Security page. Accepting one: Accept or reopen a security finding.