This page gives one-line answers to the questions people most often ask while reading a vulnerability scan, each tied to the specification or documentation behind it. Follow the links in Sources for the full text. Where an answer depends on your environment, it says so.
Identifiers and records
What does the prefix on an advisory ID mean? It names the issuing database. In the OSV schema GHSA is GitHub's advisory database, CVE is the National Vulnerability Database feed and DSA is a Debian security advisory.
What is an alias? An ID for the same vulnerability in another database. Two records are aliases if they affect a component in the same way.
Can two packages share a name? Yes. The OSV schema says zlib in npm and PyPI refers to different packages, which is why ecosystem and name are both required.
What is a PURL? A Package URL, written as scheme, type, namespace, name, version, qualifiers and subpath, such as pkg:npm/name@1.2.3.
Versions and fixes
What is the fixed version? In OSV, fixed is the first version containing the fix. That version is not affected.
What does last_affected mean? The final affected version at the time of publication. The schema says it is less precise than fixed and can allow false negatives.
Why is a patched Debian package still flagged? Debian backports fixes to the version shipped in a stable release, so the upstream number stays the same. Check the changelog or compare against the version in the Debian advisory.
Scores and severity
What are the CVSS severity bands? None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0, for both 3.1 and 4.0.
Does the base score include exploit availability? No. The CVSS 3.1 base score excludes temporal metrics, such as exploit code availability, and environmental metrics, such as controls in your setup.
What does EPSS measure? The probability of exploitation activity in the next 30 days, from 0 to 1. FIRST says it is not a complete risk score and does not measure damage.
Tool formats
What does the SARIF level field mean? It sets a result's severity as note, warning or error, and a result-level value overrides the rule's default, which is warning.
What does a VEX status of not_affected say? According to the CISA minimum requirements, no remediation or mitigation is required because the vulnerability does not affect the listed products. A justification or an impact statement must accompany it.
How to use these answers
Treat each answer as a starting point and check the primary source before you put it in a policy or a customer reply. The links below go to the documents the answers come from. If your scanner behaves differently from what these sources describe, ask the vendor which field or version it uses.
Three habits make scan output easier to read in general.
- Keep the identifier, the version and the source of each rating with the finding.
- Separate "is it present", "is it reachable" and "is it exploited" into three questions. Scanners often answer only the first.
- Write down the reasoning for any decision to defer or dismiss.
Where Safeguard fits
Safeguard's dependency scanning and reachability analysis report the components in your project and whether your code reaches the vulnerable function, which covers the first two questions above. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Match what you see to the answers above.
Quick check
Where do I find the full definition of a CVSS metric?
In the FIRST specification documents for version 3.1 and version 4.0, linked in Sources.
Is a one-line answer enough for a policy?
No. Use it to orient, then read the primary source and add your own environment details.
Sources
- FIRST, CVSS v3.1 Specification Document
- FIRST, CVSS v4.0 Specification Document
- FIRST, EPSS FAQ
- OpenSSF, OSV schema
- Package-URL, PURL specification README
- Debian, Security FAQ
- GitHub Docs, SARIF support for code scanning
- CISA, Minimum Requirements for VEX
Last reviewed: 19 October 2026.
