Understand vulnerabilities and impacts

Use this article when you see a vulnerability in Cysmiq and want to understand what it means, how serious it is, and what outcome it could have.

Vulnerability types

• Secrets: leaked credentials, API keys, and tokens.

• Code: security vulnerabilities in source code.

• Dependencies: vulnerable packages flagged by advisory databases such as CVE and GHSA.

Severity

• Critical: severe risk requiring immediate action.

• High: significant risk that should be prioritized.

• Medium: moderate risk to address in the normal workflow.

• Low: minor risk to fix when convenient.

Impacts

Impacts describe the attacker outcome if a vulnerability is exploited. They help teams prioritize by business risk rather than only technical category.

• Execute Commands: arbitrary code or command execution.

• Takeover Accounts: account takeover, authentication bypass, or session hijacking.

• Gain Access: authorization bypass or privilege escalation.

• Obtain Secrets: credential, token, or key exposure.

• Access Data: reading or changing structured data.

Canonical docs

For the maintained reference, see Vulnerabilities, Impacts, and Impact Reference.

Contact support if

• You need help interpreting a vulnerability type, severity, or impact.

• A vulnerability appears to have the wrong severity or impact category.

• A finding is missing context that you expected to see.