⚖️ SSVC

The items that name it 10

• Hitachi Energy CoreTec Product
  advisoryas tools2026-10-28

  Stakeholder-Specific Vulnerability Categorization score given for the advisory: SSVCv2/E:N/A:N/2026-10-26T15:17:24Z/

• Hitachi Energy TRO600 series products
  advisoryas tools2026-10-28

  Stakeholder-Specific Vulnerability Categorization score given for the advisory: SSVCv2/E:N/A:N/2026-10-26T14:54:19Z/

• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-19
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-15
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-10
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-09
• How Should I Prioritize Software Vulnerabilities? | Blog | Endor Labs
  articleas tools2026-09-11It is written here as SSVC (Stakeholder-Specific Vulnerability Categorization).

  Decision tree tool for determining how to evaluate and respond to vulnerabilities, pioneered by Carnegie Mellon SEI, endorsed by CISA in 2022; outputs Track, Track*, Attend, or Act

• Combining EPSS and Reachability Analysis to Optimize Vulnerability Management | Blog | Endor Labs
  articleas tools2026-09-11It is written here as SSVC (Stakeholder-Specific Vulnerability Categorization).

  Vulnerability prioritization approach that, like CVSS, does not inherently draw from live exploitation data

• OWASP OSS Risk 1: Known Vulnerabilities | Blog | Endor Labs
  articleas techniques2026-09-11It is written here as SSVC (Stakeholder-Specific Vulnerability Categorization).

  Decision-tree methodology created by Carnegie Mellon SEI and CISA accounting for exploitation status, safety impacts, and prevalence to determine vulnerability response

• BOD 26-04 Just Changed How Federal Agencies Prioritize Vulnerabilities.
  articleas tools2026-08-20It is written here as SSVC (Stakeholder-Specific Vulnerability Categorization).

  Decision-tree model used by BOD 26-04 to prioritize vulnerability remediation based on exploitation status, automatability, technical impact, and mission/well-being context, rather than a static CVSS score