Enterprise evaluation

Preview schema documentation.

SVXtream preserves vendor-specific depth behind a consistent record shape for applicability, impact, remediation, evidence and quality, then enriches CVEs with attributable CISA KEV and FIRST EPSS intelligence.

Representative shape

Preview contract

{
  "advisory": { "vendor": "nvidia", "advisory_id": "5849" },
  "applicability": {
    "products": [{
      "product": "NVIDIA AIStore framework",
      "status": "affected",
      "affected_versions": ["0 - 4.4"],
      "fixed_versions": ["4.5"]
    }]
  },
  "impacts": [{ "type": "privilege_escalation" }],
  "remediation": { "actions": [/* fixes, mitigations, workarounds */] },
  "external_enrichment": {
    "origin": "external_enrichment",
    "vendor_supplied": false,
    "cisa_kev": [{ "cve_id": "CVE-2026-16812", "known_exploited": true }],
    "first_epss": [{ "cve_id": "CVE-2026-16812", "epss_score": 0.00884 }]
  },
  "source_evidence": { "url": "https://…", "native_records": [] },
  "quality": { "status": "ok", "indicators": {} }
}

Exact fields and nesting may evolve with preview-participant feedback. Sample exports include the complete representative contract available for evaluation.

External enrichment is labelled with its provider and origin and is never represented as vendor-supplied advisory content.

Record sections

advisory: Vendor identity, advisory ID, dates, severity, CVEs and record-level counts.
applicability: Affected products, platforms, version ranges, fixed releases and package-level artifacts.
impacts: Vendor-stated operational impacts, with CVE relationships where the source supplies them.
weaknesses: CWE classifications and their relationship to the advisory or individual CVEs.
remediation: Vendor fixes, mitigations, workarounds, no-action statements and supporting references.
external_enrichment: CISA KEV known-exploitation matches, FIRST EPSS probability signals and NIST scoring, with explicit origin and vendor-supplied flags.
source_evidence: First-party URLs and vendor-native detail retained behind normalised assertions.
quality: Completeness status, rejected values and explicit indicators for downstream policy decisions.