Policy

Responsible disclosure

• We only write about vulnerabilities that are already public and have an official fix or mitigation.
• We verify only in isolated, disposable environments we build ourselves. We never test third-party systems.
• Pages never include exploit code, payloads or step-by-step reproduction; verification records describe the environment and the result only.
• For malicious-package incidents we analyse public data only and never download or run the malware.
• If a vendor or researcher thinks a page is wrong or discloses too much, email wenstudio.sunshine@gmail.com and we will reply within 72 hours.
• We do not accept undisclosed vulnerabilities. If you found a new one, report it to the vendor directly. We write about it only after it has been disclosed.

AI review rules

Pages marked "AI review (not human-reviewed)" were checked item by item against primary sources by two independent AI reviewers, and are published only if both pass every check below. If any item fails or is unclear, the page is not published. AI may then revise the page only toward the sources (weaker wording, clearer attribution) and have the whole page re-reviewed, for up to four rounds; anything still unclear goes to a person.

• IDs, product, vendor, affected and fixed versions match the vendor advisory, CVE record or GitHub advisory; where sources disagree, the page shows both and says which is which.
• Preconditions, impact and advice are no stronger or looser than the sources, and no precondition is dropped.
• "Exploited" is based only on CISA KEV, the vendor or a CERT; anything unsourced is marked unknown.
• CVSS scores and their source (CNA or NVD) and all dates match the sources.
• Where sources disagree, the check follows them upstream to the origin (the fix commit and release records, the vendor or maintainer advisory, the CVE record, CISA KEV) and goes by the origin; versions, fixes, exploitation, severity and dates cannot pass on aggregator databases or news alone.
• Every quote under "View evidence" really appears in the linked source and is not taken out of context.
• Check commands only inspect your own environment; the page has no exploit code, payloads or step-by-step reproduction, and links to no PoC.
• At least one primary source, all links work, and the English and Chinese versions state the same facts.

AI review is not reproduction; pages we have reproduced are marked "Reproduced" separately.

Corrections

To report a mistake, use "Report an error" at the bottom of any page or email wenstudio.sunshine@gmail.com. Once confirmed, we fix the page and update its date; major corrections are noted on the page.

Security of this site

If you find a security issue in plaincve.date itself, email wenstudio.sunshine@gmail.com and please do not publish it first. The contact is also listed in security.txt.

License

• Articles: CC BY 4.0. Republishing requires attribution and a link.
• Rules: MIT. Free for commercial and non-commercial use, with no warranty.

Ads, support and privacy

This site shows no ads, sets no cookies of its own and loads no third-party trackers. We accept voluntary support from readers (buy me a coffee on Ko-fi); it never influences the content or conclusions of any page.

Disclaimer

Content is for defensive and educational use only. It is compiled from public sources and may contain errors or be out of date; check the vendor's advisory before acting. We are not responsible for false positives or misses caused by our rules. Test in your own environment before deploying.