The Reachability Verdict

CVSS tells you how bad a bug would be if everything lined up. It doesn't tell you whether anything actually lines up, and that's the part I care about. So every CVE page here gets one of these four instead.

The bug is real and the code is wrong, but I couldn't get to it from anywhere an attacker would actually be standing. Needs a configuration nobody runs, or a code path that got removed two versions back, or credentials that already own the box.

Untrusted input reaches the vulnerable code on a default install. I haven't made it do anything interesting yet, but nothing is standing in the way.

I got it to do the thing it isn't supposed to do. Crash, leak, execute, whatever the bug class promises. Usually in a lab, usually with a debugger open, usually held together with tape.

It works reliably, unattended, against a stock install. This is the one I'm least likely to show you much of.

These are my read and not a standard, and I'll get some of them wrong. If a page says Theoretical and you have a working path to it, tell me and I'll change it.