About PlainCVE

PlainCVE is a vulnerability research and explainer project. We pick vulnerabilities that are exploited in the wild or matter most to development teams, check them against official advisories and original records, and explain them so that people without a security background can understand them and act: who is affected, how the attack works, and how to fix and detect it.

Scope

Mainly vulnerabilities disclosed from 2026 onward.
Priority goes to entries in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning flaws already used in real attacks.
Focus areas are the software supply chain (packages, CI/CD, developer tools) and AI security (LLM apps, AI gateways, agent frameworks).
Major incidents without a CVE, such as malicious packages, are covered too and tracked by their GitHub Advisory or OSV IDs.

Method

Collection. We keep daily snapshots of CISA KEV and OSV (npm, PyPI), including later edits to each advisory, so we can check what an advisory said on any given day.
Triage. Research order is set by focus area and whether the flaw is exploited.
Research and writing. Vendor advisories, CVE and NVD records and fix commits come first. When sources disagree (on scores or affected versions, for example), the page shows both; anything we cannot confirm is marked unconfirmed. First drafts may be prepared with AI assistance, and those pages are labelled "AI-assisted".
Review. Before any page goes public, a person checks its facts and sources, and the review date is recorded.
Verification. A page is marked reproduced only after the flaw is reproduced in an isolated, disposable environment; pages that are reviewed but not yet reproduced say so clearly. For malicious-package incidents we analyse public data only and never download or run the malware.

What's on each page

Summary	Who is affected, how bad it is, and what to do now
Attack flow	How the attack unfolds step by step, and where each step can be stopped
How it works and how to fix	A conceptual explanation with the broken and the fixed pattern
Blue-team playbook	Detect, fix or mitigate, respond, harden
Verification	What environment we used, what we did and what we saw
Media brief	Key facts with sources, what is confirmed and what is not, a glossary
Sources	At least one official advisory, fix record or CVE / NVD record per page

Editorial standards

Official sources first. News and research reports are supporting material and always credited.
Original writing. Explained in our own words, never copied from sources.
Defence and education only. No exploit code, payloads or step-by-step reproduction.
Open corrections. Errors are fixed on the page; see the policy.

Readers

Developer: I need to fix and block it
Journalist: I need an accurate, quotable summary
Student: I want to understand how it works
Researcher: I want the details and rules

Research and development

PlainCVE is a personal research project by Wen Studio. Wen Studio's background is in product security analysis and it handles the research, review and development of this site.

Support PlainCVE

PlainCVE is a one-person project done outside working hours, and everything on it is free. If these write-ups helped you, a coffee keeps me going.

Buy me a coffee on Ko-fi

Support never influences the content or conclusions of any page.