aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
https://public.vulnerablecode.io
Apache License 2.0
543 stars 201 forks source link

Factor in severity from AffectedByPackageRelatedVulnerability in package risk computation #1671

Open keshav-space opened 3 days ago

keshav-space commented 3 days ago

Current design(https://github.com/aboutcode-org/vulnerablecode/issues/1543) takes into account the severity available globally at the vulnerability level. Going forward, we also need to factor in the severity available at the package-vulnerability intersection.