A CVE page on Gold packs the key facts about one vulnerability into a single view: severity badge, fix status, description, CVSS score and vector, EPSS probability, weakness type and a timeline. Read status and the description first, then CVSS and EPSS together, then remediation text last.
Title, severity and status
The title gives the CVE id and the affected package. A severity badge such as High sits next to a status badge. On the example page we reviewed, status read "not-fixed" and the fix version badge read "Not Available". That pair is your first decision point: if a fix exists, plan the upgrade. If not, you need a mitigation.
Description and impact
The description is the advisory text, for example an authorization plugin bypass triggered by oversized request bodies. The impact section is generic language about unauthorized access or compromise. Use the description for real detail and treat the impact paragraph as boilerplate.
CVSS score and vector
CVSS v3.1 base score runs from 0 to 10 and, per FIRST, measures severity based on intrinsic characteristics of the flaw. FIRST also says the base score should not be used alone to assess risk. The vector string records how the score was built. The example showed 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access, low complexity, low privileges needed, no user interaction, and high impact on all three of confidentiality, integrity and availability.
EPSS
EPSS is a probability that exploitation will be observed in the next 30 days, from 0 to 1 per FIRST. The page shows it as a percentage with a comparison to other CVEs. A low EPSS next to a high CVSS is common. It does not mean ignore it. It means exploitation is not currently being observed at scale. EPSS does not know your environment.
Weakness type and quick facts
CWE gives the class of weakness behind the bug, such as improper authentication. Quick facts list published and last modified dates and who discovered it. Dates tell you how long the issue has been public.
Remediation, mitigations and timeline
Remediation text on the page is generic: review affected systems, add controls if you cannot patch, monitor. Mitigation strategies carry a priority label. The event history shows what happened and when. A timeline with one event is normal for a fresh or quiet CVE.
What the page may not show
On the page we reviewed there was no Known Exploited Vulnerabilities flag, affected version list or reference links. If you need to know whether the CVE is in CISA's KEV catalog, check CISA directly, since CISA advises using KEV as an input to prioritization.
A fast routine
- Status and fix version.
- Is the vulnerable component in your build, and is it reachable?
- CVSS vector for attack path, EPSS for current signal.
- KEV check at CISA.
- Decide: upgrade, mitigate or accept with a date.
Safeguard's reachability analysis helps with step two on your own code, and the free scan at gold.safeguard.sh/scan shows which packages in a manifest carry known vulnerabilities.
Quick check
Is a High CVE always urgent?
No. Severity describes the flaw, not your exposure. Combine it with fix status, EPSS, KEV status and whether the code is reachable.
What does not-fixed mean?
No fixed version is recorded. Look for vendor mitigations and monitor for a release.
Sources
Last reviewed: 19 October 2026.
