When a vulnerability lands in one of your products, the scanner findings and the SBOM tell you what’s wrong internally. The next job is the hard one: tell your customers, in a form they can act on, and prove you did it. That is the Product Security Incident Response Team (PSIRT) function — and most teams run it out of a spreadsheet and a mail-merge.
Talarity’s Product Advisories page is a real PSIRT surface. Author an advisory about your own product, score it with CVSS v3.1, export a machine-readable CSAF 2.0 document, see instantly whether any of its CVEs are in the CISA Known Exploited Vulnerabilities catalog, and notify affected customers — all on a coordinated-disclosure lifecycle (draft → published → withdrawn) with a per-org advisory number.
The advisory register
Open Application Security → Product Advisories. Every advisory is one row: its ADV-YYYY-NNNN number, title, severity with the CVSS score, status (draft / published / withdrawn), a KEV column that lights up “Exploited” when a CVE is in the CISA catalog, and its publication date.
The number is assigned only at publish time — drafts don’t burn one — so your public advisory IDs stay dense and sequential.
Draft it, and let CVSS do the scoring
Click + New advisory. Write the title and summary, then enter the CVSS v3.1 vector. Talarity computes the base score on the server — the exact FIRST specification formula, rounded up to one decimal — and the derived score and severity become authoritative: the Severity field greys out because the vector governs it.
Add the affected products and version ranges, the CVE identifiers, and the CWE weakness classes. Everything you record flows into the machine-readable export in the next step.
Publish — with a CISA-KEV check and a CSAF document
A published advisory carries the whole picture. The header states the ADV number, status, severity, and CVSS score; a KNOWN EXPLOITED badge appears when one or more of the advisory’s CVEs are in the CISA Known Exploited Vulnerabilities catalog — the single most important signal for a customer deciding how fast to patch. Every advisory can be downloaded as a CSAF 2.0 JSON document, the OASIS standard your customers’ own tooling can ingest automatically.
The KEV catalog is kept current by a nightly sync of the live CISA feed, so the check reflects the real, present-day exploited-in-the-wild status — not a stale snapshot.
Notify the customers who are affected
Click Notify customers. Build the recipient list a row at a time: an app user (chosen by name from your org — not a raw id), an email address, or a contact from your address book. App users get an in-app notification; email and contact recipients get an email through the standard mail queue. Talarity records who was notified and when.
Withdraw and reissue — never quietly edit
A published advisory is a public record, so you don’t silently edit it. If it turns out to be inaccurate or is superseded, you withdraw it with a documented reason. The advisory goes terminal — its only remaining action is downloading the (now withdrawal-stamped) CSAF document — and you issue a fresh advisory in its place.
Find what you need
Filter the register by status or severity, or search by title — pull “every published advisory” or “every critical” in one click.
What you walk away with
A coordinated-disclosure PSIRT workflow that produces audit-ready, machine-readable advisories: CVSS-scored on the FIRST specification, exported as CSAF 2.0, checked live against the CISA KEV catalog, published under a per-org advisory number, and pushed to the customers who need them — with a withdraw-and-reissue discipline that keeps your public record honest.
The page maps to the standards your customers’ security teams already speak: CVSS v3.1 (FIRST.org, base-metric group), CSAF 2.0 (OASIS, the machine-readable successor to CVRF), the CISA Known Exploited Vulnerabilities catalog (BOD 22-01), and the coordinated-disclosure practice of ISO/IEC 29147 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling), operationalized the way the FIRST PSIRT Services Framework describes.