Glossary

Plain meanings for the terms used on this site.

Advisory

A notice from a vendor or project that describes a vulnerability, the versions it affects and the versions that fix it.

Affected and exposed

Affected means a version has the flaw. Exposed is how these tools use the word: the version is affected and the conditions needed to reach the flaw are present on this machine.

Backport

A fix a distribution applies to an older release, so the package keeps its old version number. This is why the tools read a package's changelog and not only its version number.

CVE

A public identifier for one vulnerability, written like CVE-2026-110353.

CVSS

A score from 0 to 10 for how severe a vulnerability is. Critical is 9.0 to 10, High is 7.0 to 8.9, Medium is 4.0 to 6.9 and Low is below 4.0. Vendors often score the same flaw differently.

CWE

A category of weakness, for example CWE-287, improper authentication.

Cross-site scripting (XSS)

Getting a victim's browser to run an attacker's script as if it came from a site the victim trusts.

Denial of service (DoS)

Making a service slow or unavailable instead of taking it over.

Deserialization

Turning stored or received data back into objects. If an attacker controls that data, it can end in running the attacker's code.

End of life

A version the vendor no longer fixes. The only remedy is to move to a supported version.

Exploited in the wild

Attackers are using the flaw against real systems, not only in a lab.

Fix and mitigation

A fix is the vendor's update. A mitigation is protection that makes the flaw harder to reach until you update. It does not replace the update.

Indicator

Something you can observe, such as a file, a log line, a process or a network connection, that suggests a flaw was used. hunt looks for indicators. A clean hunt means none of the published indicators were found.

KEV

The Known Exploited Vulnerabilities catalog kept by the US agency CISA: flaws confirmed to be exploited.

Memory corruption

Bugs where a program reads or writes memory it should not, such as a use-after-free or an out-of-bounds write. They can crash a program or let an attacker run code.

Path traversal

Using ../ in a path to reach files outside the folder an application meant to allow.

Privilege escalation

Gaining more rights than you were given, for example a local user becoming root.

Remote code execution (RCE)

Running the attacker's code on your machine from across the network.

Rollback

Undoing what mitigate changed.

SQL injection

Putting database commands into input that an application passes on to its database.

Server-side request forgery (SSRF)

Tricking a server into making requests for the attacker, often to addresses that are only reachable from inside.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.