Critical · urgent · major — the vendor's top rating, or no rating while CVEs are listed: red pill and barImportant · high · medium — the vendor's second ratingModerate · medium · low — the vendor's other ratingsthe rating is the vendor's: AlmaLinux Critical / Important / Moderate, Low; Fedora and EPEL urgent / high / medium, low; Ubuntu (USN OVAL) Critical / High / Medium, Low; nginx.org major / medium / low; modules — CVSS from the CVE record critical / high / medium, low; PowerDNS Critical, High / Medium / LowUbuntu pockets: proposed — published for testing, updates — released, security — released as a security fix
sources and rules (5) · checked 3 min ago
okUbuntu 24.04 LTS · nginx · Launchpad · checked · changed method Launchpad API (getPublishedSources): when the nginx source was published in proposed, updates and security, its status · rule every 15 min; the first time — a year of history; Launchpad is down — the archive's Release and Sources.xz (archive.ubuntu.com, security.ubuntu.com; sha256 from Release): a new kernel shows up with the Release time
304Ubuntu 24.04 LTS · nginx.org (stable, mainline) · checked · changed method conditional GET of repomd.xml (RPM) or Release (Ubuntu) of the stable and mainline branches → on change: the RPMS/ or pool/ listing (when the nginx file appeared) · rule every 30 min, and after the canary file changed — at once and every 5 min for an hour; nginx.org is down — mirrors (mirrors.ustc.edu.cn, mirror.nju.edu.cn; revision not older than seen): versions from primary.xml.gz / Packages.gz, time from the file's Last-Modified; fixed CVEs come from the nginx.org advisories page
okUbuntu · nginx notices (USN) · checked · changed method the notices RSS → JSON of new nginx notices → USN number, date, CVEs for the source version · rule every 30 min; the first time — 2 pages of notices.json per release; the rating comes from the USN OVAL
304nginx.org · security advisories · checked · changed method conditional GET → HTML parsing: title, rating (major, medium, low), CVE, vulnerable and not vulnerable versions · rule every 30 min
304Ubuntu noble · notice ratings (USN OVAL) · checked · changed method conditional GET of the release's USN OVAL (bz2) → Ubuntu's rating of every notice (Critical, High, Medium, Low) · rule every 6 h; ~1.3 MB, only when changed; shared by kernels and nginx
vigil