cms and framework advisories

What it can report

• · info (info), never "no known vulnerabilities". Web servers and languages (nginx, Apache httpd, PHP, IIS) are always in that group: distributions back-port fixes without changing the version number. - KEV never matches by product name: only a CVE that a version-matched advisory names is looked up. How to fix it
• ! low OSV advisories cover the CMS/application version the page shows. At most low: the version can be stale (cached generator tag) and hosts back-port fixes, so it is a lead, not a verdict. How to fix it
• ! medium one of those advisories is a CVE on CISA's KEV list (exploited in the wild); medium, not higher, for the same "may be patched" caveat. How to fix it

How it counts

The score is computed by fixed rules from the checks that ran, and this check has a weight of 2 within Security. A check that errors or is skipped is shown as "could not check" and left out of the score, never counted as a pass. Fixes and the AI summary are written after scoring and never change it.

Related checks

• certificate chain and expiry
• certificate names and validity window
• TLS protocol versions
• cipher suites
• HSTS
• HTTP to HTTPS redirect