CASCACascade Atlas

Evidence dossier

CVE-2021-25337

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Exploited in the wild (CISA KEV since Nov 8, 2022). NVD reports CVSS 3.1 7.1. Severity assessments differ within at least one CVSS version. EPSS estimates 2.8% exploit likelihood as of Aug 27, 2026.

57.0–65.3Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

State
PUBLISHED
Published
Mar 4, 2021
Updated
Oct 21, 2025
Evidence coverage
87%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    Samsung Mobile

    Record text: Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

    Inspect raw assertion
    Field
    container
    Value
    Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Samsung Mobile Devices Improper Access Control Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Samsung Mobile Devices Improper Access Control Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 2.83% probability · 85.59th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.028310000000; percentile 0.855920000000
    Original evidence ↗

Assessments differ

NVD7.1CVSS 3.1 · source date omitted
NVD5.8CVSS 2.0 · source date omitted
mobile.security@samsung.com4.4CVSS 3.1 · source date omitted

Values are shown separately by source and CVSS version.

ExploitationCatalog member

CISA KEV · catalog date Nov 8, 2022 · first observed Jul 19, 2026

Exploit likelihood2.83%

FIRST EPSS · score date Aug 27, 2026 · 85.6th percentile · first observed Aug 27, 2026

SeverityAssessments differ

NVD · CVSS 3.1 · first observed Jul 19, 2026 · values shown separately below

Evidence detail

Source limits and decisions

Why each evidence state has this value

Outside this view’s verified evidence

Reason detail begins outside this selected snapshot; the state remains source-bound.

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
Samsung MobileOriginal assertion
Record text

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.

Inspect raw assertion
Field
container
Value
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Samsung Mobile Devices Improper Access Control Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Samsung Mobile Devices Improper Access Control Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

2.83% probability · 85.59th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.028310000000; percentile 0.855920000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
48Underlying assertions
1Canonical products
48Target assertions
0Constraint assertions

Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

2 scope groups

Samsung Mobile · source assertedSamsung MobileSamsung Mobile DevicesDirect source scope
Affected: Selected P(9.0), Q(10.0), R(11.0) to before SMR Mar-2021 Release 1 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "Selected P(9.0), Q(10.0), R(11.0)", "lessThan": "SMR Mar-2021 Release 1", "versionType": "custom"}]
NVD CPE · OPERATING SYSTEMsamsungandroidVulnerable target · 48 assertions
Version 10.0; Version 11.0; Version 9.0Canonical identity product-bfc06cdae9e73738e7672364f70046bdc0b0c8dcf806dda71f982d32086f0748Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:samsung:android:11.0:smr-feb-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 46
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    25b42ce0-67de-4611-8d70-deec975e32ba
  2. cpe:2.3:o:samsung:android:10.0:smr-jan-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 36
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    878aaf2d-e54a-4145-a618-81341ed4b0c8
  3. cpe:2.3:o:samsung:android:9.0:smr-apr-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    18d4924f-44ab-4e63-8040-d0b96f147bc1
  4. cpe:2.3:o:samsung:android:9.0:smr-nov-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 22
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b4561f7f-6b1f-412d-a174-5f9709acf806
  5. cpe:2.3:o:samsung:android:10.0:smr-nov-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 41
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cfcffc02-efef-4a4c-a9a3-8bf355e36601
  6. cpe:2.3:o:samsung:android:10.0:smr-feb-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 34
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    18c71f11-7599-4ae1-b455-c7a50d8d5f4d
  7. cpe:2.3:o:samsung:android:9.0:smr-apr-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    858555e6-5d30-4bbf-a5cd-fd1882209abb
  8. cpe:2.3:o:samsung:android:9.0:smr-aug-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8150e4fa-8f29-4974-bde8-ed192879defa
  9. cpe:2.3:o:samsung:android:9.0:smr-oct-2018-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 24
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9282540e-26c5-4140-9074-480db7f5de41
  10. cpe:2.3:o:samsung:android:10.0:smr-nov-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 42
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    cb4658b8-9120-48e1-8a92-3430cbc6dc9b
  11. cpe:2.3:o:samsung:android:10.0:smr-jul-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 37
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f3a43712-94ef-4670-a2fd-4363cbe850da
  12. cpe:2.3:o:samsung:android:11.0:smr-dec-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 45
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    c26195a5-31be-4116-8f31-9f25be57ab52
  13. cpe:2.3:o:samsung:android:9.0:smr-may-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 19
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9f7d7092-5423-4cd1-819d-b784106d1342
  14. cpe:2.3:o:samsung:android:10.0:smr-dec-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 32
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7c7b9407-d5e0-49eb-a05d-c5e02060af36
  15. cpe:2.3:o:samsung:android:9.0:smr-jun-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 15
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    28950ddb-004f-4e01-9bbd-f5a320556d53
  16. cpe:2.3:o:samsung:android:9.0:smr-may-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 20
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7ca7ea43-3cd8-4529-9071-3fb14ee30f45
  17. cpe:2.3:o:samsung:android:9.0:smr-jun-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 16
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    48b55cf5-cf20-48f7-a806-1234436566e1
  18. cpe:2.3:o:samsung:android:9.0:smr-jan-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 10
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d52a71ae-3d39-4f29-806b-603fe098510a
  19. cpe:2.3:o:samsung:android:9.0:smr-feb-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 8
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6ab1563d-a951-4a9c-b348-0684da242b05
  20. cpe:2.3:o:samsung:android:9.0:smr-sep-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 28
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2427a8f0-035e-4db5-8b91-ebd8e826f6da
  21. cpe:2.3:o:samsung:android:10.0:smr-apr-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 29
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    49da0b6e-5e55-4893-8225-299e20da2dd0
  22. cpe:2.3:o:samsung:android:9.0:smr-feb-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 7
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    08e7c018-1293-4e29-83eb-af177ca6b179
  23. cpe:2.3:o:samsung:android:9.0:smr-dec-2018-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    72145ba5-c781-4e36-bb39-33dd92b2f801
  24. cpe:2.3:o:samsung:android:10.0:smr-oct-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 43
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7685db5c-c3c2-44e2-ab00-cee65c68460b
  25. cpe:2.3:o:samsung:android:9.0:smr-sep-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 27
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0ec7719c-8c21-4203-9ed9-e4c048fa5cf1
  26. cpe:2.3:o:samsung:android:9.0:smr-jul-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 13
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    60e1950a-282d-4065-aaa5-9bbb7f8d2c5d
  27. cpe:2.3:o:samsung:android:10.0:smr-sep-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 44
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    47335942-37fb-4a1d-837a-5d0b2883ed10
  28. cpe:2.3:o:samsung:android:9.0:smr-nov-2018-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 21
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5a9693c8-fe11-4e03-8d4a-0d6fe77627df
  29. cpe:2.3:o:samsung:android:9.0:smr-dec-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6986831f-0af0-4719-ba45-4485d44d6707
  30. cpe:2.3:o:samsung:android:9.0:smr-mar-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 17
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bf3fe371-e773-4af6-a8dc-0fd9ef615647
  31. cpe:2.3:o:samsung:android:9.0:smr-jan-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 12
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b93a5f5f-bf53-44d3-9583-811cc284df86
  32. cpe:2.3:o:samsung:android:9.0:smr-dec-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a2e3ed73-5cf8-451f-914b-123b2312110d
  33. cpe:2.3:o:samsung:android:10.0:smr-jan-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 35
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    91ea248a-4d4d-4a50-ac33-7098e17b7892
  34. cpe:2.3:o:samsung:android:10.0:smr-mar-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 39
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9fa38aa3-a747-424e-b07e-f7931fa353f0
  35. cpe:2.3:o:samsung:android:9.0:smr-oct-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 26
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    59bf1a24-8ac5-482f-b872-38d625fc669f
  36. cpe:2.3:o:samsung:android:9.0:smr-jul-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 14
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4996eb5e-1fab-4799-ae46-8176d74c49d6
  37. cpe:2.3:o:samsung:android:9.0:smr-feb-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 9
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3b9a3b41-aac9-4e23-a265-959a9852b94c
  38. cpe:2.3:o:samsung:android:11.0:smr-jan-2021-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 47
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ac082e25-1b7d-473d-a066-1463e6321cd5
  39. cpe:2.3:o:samsung:android:10.0:smr-jun-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 38
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    fdcc210b-4083-494c-a233-fe2ca672004b
  40. cpe:2.3:o:samsung:android:10.0:smr-feb-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 33
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f10815ef-aa9d-4899-b4ef-ed7a96e46959
  41. cpe:2.3:o:samsung:android:10.0:smr-dec-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 31
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6a0b5d2c-7aed-4330-adad-60f78a6a08da
  42. cpe:2.3:o:samsung:android:9.0:smr-aug-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d021b217-c481-43d1-a3e6-375e40bd4fb1
  43. cpe:2.3:o:samsung:android:10.0:smr-aug-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 30
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ef52b720-dc8c-4ef0-b20b-7fa8b192fafb
  44. cpe:2.3:o:samsung:android:9.0:smr-oct-2019-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 25
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bb304e43-dccb-42e1-8b44-0825c9c437fb
  45. cpe:2.3:o:samsung:android:9.0:smr-nov-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 23
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a54f7006-979f-4df5-a350-77dc3a68536e
  46. cpe:2.3:o:samsung:android:10.0:smr-may-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 40
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9b48628c-6780-46b4-b717-8589658b0dce
  47. cpe:2.3:o:samsung:android:9.0:smr-mar-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 18
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    45104240-9d60-47ea-8582-1f912fe7a1f2
  48. cpe:2.3:o:samsung:android:9.0:smr-jan-2020-r1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 11
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    10c1df2b-8371-4259-9139-7260eacee98d

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 0 source-reported links

Applicability remains source-scoped; safety and exposure remain unassessed.

Assessments

CVSS by origin

7.1
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
5.8
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:M/Au:N/C:P/I:P/A:N
4.4
mobile.security@samsung.comCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
4.4
Samsung MobileCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.