Glossary

Resilic uses terms from the vulnerability world that are not everyday language in machine building. This page says what each one means, who is behind it and where it shows up in Resilic. The terms themselves are kept as they are, because databases, standards and suppliers use them exactly like this.

Vulnerabilities and identifiers

CVE (Common Vulnerabilities and Exposures) is the identifier used worldwide for a publicly known vulnerability, such as CVE-2026-12345. The programme is run by the US organisation MITRE; vendors, researchers and authorities use the identifier to refer to the same vulnerability. In Resilic every match in the vulnerability view carries its CVE identifier.

CVSS (Common Vulnerability Scoring System) rates the technical severity of a vulnerability on a scale from 0 to 10. The score says how bad exploitation would be, not how likely it is. That is what EPSS and KEV are for.

EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will actually be exploited within the next 30 days. The model is run by the FIRST consortium. Resilic shows the value as context for prioritisation; it does not trigger a reporting obligation.

KEV (Known Exploited Vulnerabilities) is the catalogue kept by the US agency CISA of vulnerabilities with evidence of active exploitation. A KEV entry is the strongest signal in Resilic, because it answers exactly the question Article 14 asks: is this vulnerability being actively exploited?

Actively exploited vulnerability is the term from Article 14(1) CRA. A vulnerability in one of your products whose exploitation becomes known to you starts the reporting cascade (24 hours, 72 hours, 14 days). Details under reporting.

Databases and sources

EUVD (European Union Vulnerability Database) is the European vulnerability database that ENISA operates under Article 12 CRA. It lists CVE entries with European context and receives the reports submitted through the Single Reporting Platform.

NVD (National Vulnerability Database) is the US counterpart run by NIST. It enriches CVE entries with CVSS scores, affected products (CPE) and references.

ENISA is the European Union Agency for Cybersecurity. It operates the EUVD and the Single Reporting Platform through which manufacturers submit their Article 14 reports.

CISA is the US Cybersecurity and Infrastructure Security Agency. It maintains the KEV catalogue.

CSAF (Common Security Advisory Framework) is the machine-readable format for vendor security advisories, standardised by OASIS. Resilic reads the CSAF feeds of your suppliers and can publish your own advisories as CSAF.

Software and components

SBOM (software bill of materials) lists which software components, in which versions, a product contains. The CRA requires it in Annex I Part II as a software bill of materials in a commonly used, machine-readable format. Resilic imports SBOMs in the CycloneDX and SPDX formats and correlates the components against the vulnerability databases.

CycloneDX and SPDX are the two common SBOM formats. CycloneDX comes from OWASP, SPDX from the Linux Foundation; Resilic imports both.

PURL (package URL) is a standardised address for a software package, such as pkg:npm/[email protected]. It identifies a component unambiguously across vendors and formats.

CPE (Common Platform Enumeration) is the identifier the NVD uses to name affected products, firmware and devices. Resilic uses it to attribute scanner findings and components to a vendor and a version; see scanners in the field.

VEX (Vulnerability Exploitability eXchange) is a vendor’s statement on whether a vulnerability is actually exploitable in a product. It is often distributed as part of a CSAF advisory. Resilic reads the affected products from CSAF advisories; a supplier’s VEX statement does not replace your own assessment.

Regulation

CRA (Cyber Resilience Act) is EU Regulation 2024/2847 on horizontal cybersecurity requirements for products with digital elements. The Article 14 reporting obligations have applied since 11 September 2026, the remaining obligations apply from 11 December 2027. What that means for machine builders is in the overview.

Single Reporting Platform is ENISA’s central reporting platform through which manufacturers submit early warnings, notifications and final reports under Article 14. Resilic prepares the reports to fit; a human submits them.