Skip to main content

The corpus

The corpus is the CVE catalog that Wazuh CTI publishes, and Pharos keeps a live mirror of it: over 366,000 CVE records, the vendors, products and packages they affect, the verdict of every source that has ruled on each record, and the revision stream upstream publishes as records change.

What a record carries​

Eight sources are normalized into a record where they have ruled: NVD, Amazon, ArchLinux, Canonical, Debian, Fedora, Red Hat and SUSE. Each carries its own score, and they disagree. NVD can say 10.0 where Red Hat says 5.3, and which verdict matters depends on what the fleet runs, so the CVE page shows them side by side instead of picking a winner.

On top of what upstream publishes, Pharos adds three enrichments: the EPSS exploit-prediction score published by FIRST, membership in the CISA KEV catalog of known exploited vulnerabilities, and exploit availability.

Vendors, products and packages are first-class objects with their own pages. A count on screen is always the real total rather than the page size: a list capped at 200 rows says so, next to the true number.

How fresh the mirror is​

Upstream publishes its changes as an append-only stream, and the mirror follows that stream every hour. The EPSS scores and the KEV catalog refresh once a day.

The revision timeline, and its horizon​

Every record carries a version counter, and each version is a retrievable revision. Pharos rebuilds the sequence as a timeline on the CVE page: what changed, when, and which source changed it.

The timeline has an honest horizon. It exists from the day Pharos began capturing the change stream, so a CVE published in 2019 that shows a single entry is not missing data. Its earlier revisions predate capture, and the single entry is the state the record arrived in.

Free text reaches identifiers, titles and package names, so libssl3 is a valid query and lands on the package. Results filter by severity, CVSS floor, EPSS floor, KEV membership, exploit availability, source, vendor, product, package, CWE and publication window, and sort by publication date, last update, score, EPSS, source count or revision count.