Methodology & Source Tiers

We classify all information sources into four tiers: Primary (official statements, vendor security advisories, CERTs, NVD, CISA KEV), Secondary (named security research firms), Tertiary (established technology media), and Excluded as sole source (forums, anonymous posts). Every factual claim in an advisory must cite at least one reference source. Our own editorial judgment appears only in the "Our analysis" and "Our addition" sections, clearly labeled. Severity ratings prioritize official CVSS v3.1 / v4.0 scores published by NVD or the vendor. When no official score exists yet, we provide our own assessment based on scope and exploitation status, noting the basis.