Disclaimer
Effective 29 October 2026
Information, not a guarantee
CVEfocus tells you which publicly known vulnerabilities may apply to the software versions you send, based on data published by the sources below. Please read the results with these limits in mind:
- Not complete. Only publicly disclosed vulnerabilities from our sources are covered. Undisclosed vulnerabilities, misconfigurations, software we don't support and anything not in your inventory are not.
- Only as good as the sources. Vendors and databases sometimes publish late, change their assessments or make mistakes. We show when each source was last updated in every response.
- "Not listed" is not "safe". An empty result means we found no known, matching vulnerability in our data at the time of the check. It is not a statement that a system is secure.
- Priorities are guidance. "Act now", "This week", "Plan" and "Monitor" come from fixed rules using public signals (CISA's Known Exploited Vulnerabilities, EPSS, CVSS and vendor ratings). They don't know your environment, exposure or business impact.
- Commands are suggestions. Upgrade and reboot commands are shown as convenience. Test changes before applying them to production; updates and reboots can cause downtime or break applications.
- Not professional advice. CVEfocus does not replace your own security assessment, penetration testing or advice from qualified professionals, and does not by itself demonstrate compliance with any standard.
You remain responsible for the security of your systems and for decisions you make using the Service. See the Terms of Service for the warranty disclaimer and limitation of liability.
Data sources and attribution
CVEfocus combines public data from these sources. Each source's own terms apply to its data. We are not affiliated with or endorsed by any of them.
| Source | Used for |
|---|---|
| CVE® List, CVE Program | All published CVE records: descriptions, severity, affected products reported by CVE Numbering Authorities |
| Canonical: Ubuntu security data and VEX statements | Ubuntu fixed versions and Ubuntu's status per release |
| Debian Security Team (via OSV.dev) | Debian fixed versions |
| Red Hat, AlmaLinux, Rocky Linux security advisories (via OSV.dev) | RHEL-family fixed versions |
| OSV.dev (Google) | Distribution data exports |
| CISA Known Exploited Vulnerabilities Catalog | Whether a CVE is being exploited |
| EPSS by FIRST.org | Probability of exploitation |
CVE® is a registered trademark of The MITRE Corporation. Ubuntu is a registered trademark of Canonical Ltd. Debian is a registered trademark of Software in the Public Interest, Inc. Red Hat and Red Hat Enterprise Linux are trademarks of Red Hat, Inc. AlmaLinux and Rocky Linux are trademarks of their respective owners. Other names may be trademarks of their owners and are used only to identify their products.
Questions or corrections
If you believe a result is wrong, email info@cvegroup.com with the CVE and package. We'll check it against the source.