Vendor Security Advisories, Now on Every CVE Page

A CVE record tells you which upstream versions are affected. It does not tell you what Red Hat, SUSE or Cisco shipped for their products, which is the question you actually have when you run a distribution or an appliance.

VulnTracker now answers it. Under the remediation guide on each CVE page, you'll find the vendors' own security advisories for that CVE, pulled straight from the vendors.

What you see

For every advisory that mentions the CVE:

• Who published it, their advisory ID (an RHSA-…, a cisco-sa-…), the title and the date.
• The vendor's own severity and score, labelled as theirs. We never merge it with NVD's.
• What they did about it: how many of their products are fixed, affected, not affected or still under investigation, and the kind of remediation.
• A flame when the vendor itself says the vulnerability is being exploited. That's the vendor's judgement, shown separately from CISA's KEV listing.

Each advisory opens on its own page, where you can read the vendor's notes in full, the "what to do" steps and workarounds in the vendor's own words, their scores, and, for products marked not affected, why: the vendor's reason, as published.

Straight from the vendors

These advisories come from the vendors' own sources, kept as the vendor wrote them. Today that is Red Hat, SUSE, Cisco, Germany's CERT-Bund and CISA: more than 100,000 advisories, and more than 60,000 CVEs with at least one. More vendor sources are on the way.

The aim is simple: everything published about a vulnerability, on one platform and on one page. The CVE record, our resolved answer, NVD's data, KEV, EPSS, SSVC, and now the vendors' own advisories, next to each other.

Browse every advisory

There is also a page for the advisories themselves: vulntracker.io/advisories lists every vendor advisory we hold, newest first, with a tab per publisher, a severity filter, a search box and a last 7/30/90 days switch. Filters live in the URL, so a filtered view can be shared. Severity is normalised to one scale for filtering, so a single click reaches Red Hat's "Important" and CERT-Bund's "hoch" alike, and the vendor's own word stays visible on hover.

Each advisory has a readable address, for example /advisories/RHSA-2025:1746. That one covers 18 CVEs across 38 products and is on its third revision, which is the point of giving advisories their own pages: one advisory is not one CVE, and not one patch. To find a specific advisory, paste the vendor's full ID, such as RHSA-2026:2771 or cisco-sa-….

The ten newest advisories also appear on the VulnTracker home page, live.

Why it matters

Two reasons:

1. Distribution users get the real fix. "Fixed in 2.4.52 upstream" does not tell a RHEL admin anything. "Fixed in httpd-2.4.37-47.el8, see RHSA-…" does.
2. The vendor's exploitation statement is the earliest signal you'll get. Vendors often say "exploited in the wild" in their own advisory before a CVE reaches CISA's KEV list. Now that statement is on the page, marked as the vendor's.

Open a CVE that affects Red Hat or SUSE packages, or a Cisco product, and scroll to Vendor advisories, or start from vulntracker.io/advisories. No account needed.