CyphrQHow to Read a CVE Record and NVD Entry (and the 2025 Funding Scare)
Read a CVE record and an NVD entry field by field, with a real example, and learn what the 2025 CVE funding scare and NVD backlog mean for defenders.
Vulnerabilities & CVEs
Vulnerabilities that matter, how they are scored and tracked, and the public databases to check them in.
3 articles
Articles
php2shell (CVE-2026-109618): Two Critical PHP RCE Flaws and How to Patch Them
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution. Fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35. What to do now.
CVSS vs EPSS vs KEV: Which Vulnerabilities to Patch First
CVE, CVSS, EPSS and KEV explained in plain language, with a Log4Shell worked example and a simple order for deciding which patches come first.
Where to look things up
| Name | What it is |
|---|---|
| CVE Program (cve.org) | The official CVE list, run by MITRE for CISA: the ID and description for each public vulnerability. |
| NVD (NIST) | US National Vulnerability Database: CVSS scores, affected products (CPE) and weakness types for each CVE. |
| CISA KEV catalogue | Vulnerabilities known to be exploited in the wild, with remediation due dates for US federal agencies. |
| EU Vulnerability Database (ENISA) | The EU's vulnerability database, run by ENISA under the NIS2 directive. |
| FIRST EPSS | Exploit Prediction Scoring System: the daily probability that a CVE will be exploited in the next 30 days. |
| MITRE CWE | Common Weakness Enumeration: the types of flaw (such as SQL injection) behind vulnerabilities. |
| MITRE ATT&CK | Attacker tactics and techniques seen in real intrusions, for mapping what a vulnerability enables. |
| OSV.dev | Open-source vulnerability database for package ecosystems such as npm, PyPI and Go. |
| GitHub Advisory Database | Security advisories for open-source packages, linked to CVEs where they exist. |
| Aqua Vulnerability Database (AVD) | Vulnerability and misconfiguration entries for containers, cloud and Kubernetes. |