CVE age

CVE age (or exposure age) is the number of days between a vulnerability’s publication date and today. The older it is, the more time attackers have had to build and spread an exploit.

The question Leavory answers is: “has this flaw been public for more than N days, and is it still here?”

• Age is counted from the vulnerability’s publication, not from when it appeared in your repository.
• Only CRITICAL and HIGH count toward the rule. MEDIUM and LOW still show up on the other screens.
• The limit is yours: for example, 7 days for CRITICAL and 30 for HIGH.

Possible statuses

Status	Meaning
Over the limit	Published more days ago than the limit for its severity
Within limit	Published fewer days ago (or exactly at the limit)
No date	No source has the date. It never counts as over the limit

See where the date comes from in Vulnerability databases.