Read the signals without conflating them

Severity describes the vulnerability

An advisory’s severity and CVSS score describe its technical characteristics and impact under the scoring assumptions. They help you understand the issue, but they do not establish whether your application runs the affected code or is reachable by an attacker.

Known exploitation is an evidence signal

CISA’s Known Exploited Vulnerabilities catalog records vulnerabilities for which CISA has evidence of exploitation. A checked catalog match is a reason to prioritize assessment. Absence from the checked catalog does not establish that exploitation has never occurred.

If the source check fails, Wisesama shows the source’s unavailable or degraded state. Previously observed evidence should not disappear because the newest check was unsuccessful.

EPSS is a forecast

FIRST’s EPSS estimates the probability of a published CVE being exploited in the next 30 days. It is a forecast informed by a model, rather than proof that your service has been attacked. Check the prediction’s date and the source status when using it.

Your environment supplies the exposure evidence

An inventory match means a reported affected package version was found in the assessed metadata. Investigate whether that version is deployed, whether the vulnerable feature is used, and whether an attacker can reach it.

Keep the questions separate in your response: what is installed, what the advisory says, what exploitation evidence exists, and what you verified about your own environment.