Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities

From Inventory to Advisory

Vulnerability matching starts with an inventory. It lists the installed operating system packages (from dpkg or rpm). It also lists the libraries a web application ships (from lock files such as composer.lock or package-lock.json). Each item is compared with advisories that state which versions are affected and which version fixes the problem.

OSV (osv.dev) publishes advisories in one open format for many ecosystems, including Debian, Ubuntu, AlmaLinux, Rocky Linux, Packagist and npm. Distributions often backport fixes without changing the upstream version number, which is why matching must use the distribution's own advisory data and exact package versions.

Comparing Versions Correctly

Version strings are not simple numbers. In Debian versions an epoch (1:) outranks everything. A tilde sorts before anything, so 1.0~rc1 comes before 1.0. The revision after the last hyphen counts too. RPM has its own rules, including a caret for post-release snapshots. A tool that compares versions naively reports false positives and, worse, false negatives.

Prioritising

Severity alone is a poor queue. The CISA Known Exploited Vulnerabilities catalogue lists flaws attackers are known to use in practice; those should be fixed first. Offline data also ages: a snapshot from months ago cannot know about last week's vulnerabilities, so every report states the snapshot date.

In Summary

Know what software you run. Match it against CVE and OSV data. Fix known exploited vulnerabilities first.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt vulndb and note the snapshot date and whether it is test data.
2. Run: openvapt demo --only HOST-CVE-,WEB-CVE- --out p10 and read how each finding names the installed and fixed version.
3. Read internal/vulndb/review_test.go and explain why 1.0~rc1 is older than 1.0.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OSV, Open Source Vulnerability format and database
• CISA Known Exploited Vulnerabilities Catalog
• Debian Policy Manual, Version numbering

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P10: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p10.html

@misc{openvapt_p10,
  author       = {{OpenVAPT}},
  title        = {{P10: Vulnerability Management: CVE, OSV and Known Exploited Vulnerabilities}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p10.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}