KEV (Known Exploited Vulnerabilities) - Potential Format (BCP-07)

[adulau]

@adulau

The severity field reflects the severity inferred from the exploitation assertion itself, not an abstract or vendor-defined vulnerability score. For example, a honeypot observation resulting in full system compromise would justify a high severity value. This distinction may benefit from clearer wording in the BCP document.

I updated the BCP-07 draft based on the question and feedback provided.

chg: [BCP-07] clarification about the severity · gcve-eu/gcve.eu@a0bf395