Unassigned vulnerability's severity

[nekhtan]

Hello,

NVD is taking longer and longer to assign severities to CVEs. But NVD remains the root source. So we'd like to enable GHSA and use the severity from there when it's missing in NVD. To do that, we need to find the vulnerability aliases.

Two endpoints seem to be helpful to achieve that:

• /v1/finding/project/{uuid}
• /v1/vulnerability/project/{uuid}

Which one is recommended ? Is there another endpoint to consider ?

TLDR; Is there an easy way to retrieve the aliased severity of a vulnerability when its unknown/unassigned ?

Thanks in advance for your insight !

[nekhtan]

Anyone ?