Glossary: open source, SBOM and vulnerabilities.

Short definitions of the terms that regularly appear in customer requirements, audits and the Cyber Resilience Act.

Backport

Applying a fix from a newer version to an older version of the same software that is still in use.

Copyleft

A licensing principle under which derivative works must be distributed under the same terms, e.g. GPL (strong) or LGPL and MPL (weaker, depending on how code is combined). GOVERNANCE →

CSAF

Common Security Advisory Framework: a machine-readable OASIS format for security advisories that can also carry VEX statements. TRIAGE →

CVE

A unique identifier for a publicly known vulnerability, for example CVE-2021-44228.

CVSS

FIRST's Common Vulnerability Scoring System: rates the technical severity of a vulnerability on a scale from 0.0 to 10.0, currently in version 4.0. TRIAGE →

Cyber Resilience Act (CRA)

EU Regulation 2024/2847 setting cybersecurity requirements for products with digital elements, including vulnerability handling and SBOM. CRA →

CycloneDX

A widely used machine-readable format for SBOMs and related bills of materials, standardised as ECMA-424. SBOM →

Dependency (direct, transitive)

A component your software needs to build or run; transitive means it is pulled in by another dependency rather than by you. SBOM →

Downstream

Everything that reuses an open-source component, such as distributions, products or internal forks.

EPSS

FIRST's Exploit Prediction Scoring System: estimates the probability that a vulnerability will be exploited in the next 30 days. TRIAGE →

KEV

Known Exploited Vulnerabilities: a catalogue by the US agency CISA listing vulnerabilities with evidence of active exploitation. TRIAGE →

Maintainer

The person or team that looks after an open-source project and decides on changes, releases and fixes.

OpenChain

The Linux Foundation project behind ISO/IEC 5230 (licence compliance programmes) and ISO/IEC 18974 (open-source security assurance programmes). GOVERNANCE →

OSPO

Open Source Program Office: a function that coordinates open-source use, contributions and rules within an organisation. GOVERNANCE →

Patch

A source code change that fixes a bug or vulnerability; whether a patch exists for the version you use is a separate question. TRIAGE →

Permissive licence

A licence with few obligations, mostly attribution and passing on the licence text, such as MIT, BSD or Apache-2.0. GOVERNANCE →

SBOM

Software Bill of Materials: a machine-readable inventory of a software's components and dependencies. SBOM →

SPDX

Software Package Data Exchange: a format for SBOMs and licence information, standardised as ISO/IEC 5962; it also provides the standard licence identifiers. SBOM →

Triage

Structured assessment of a vulnerability finding: is the product affected, how urgent is it, and what is decided and documented. TRIAGE →

Upstream

The original open-source project a component comes from and where fixes are officially made.

VEX

Vulnerability Exploitability eXchange: a machine-readable statement on whether a product is affected by a known vulnerability, such as not_affected, affected, fixed or under_investigation. TRIAGE →