Drafting User Advisories

While machine-readable formats like CSAF are crucial for automation, clear, human-readable User Advisories remain essential for communicating risk to end-users, system administrators, and the general public. The CVD Portal lets you draft and publish a security advisory for a report. This supports the transparency requirements of the Cyber Resilience Act (CRA).

You draft the advisory in the advisory panel on the submission page. An admin can create the draft after the report has the status Resolved. Each report can have one advisory. The draft holds a title, a summary, the affected product, the fixed version, the severity and a CVE identifier. You can credit the researcher by name when the researcher agreed. You can also add a German translation of the title and summary.

An admin publishes the advisory with Publish. The advisory then appears on your public portal. Withdraw removes it from the public feed. An API key with the advisory:draft scope can edit a draft. When such a key asks to publish, the portal puts the request in the approval queue for a person to approve.

The machine-readable Article 14(8) advisory export (CSAF VEX) is available on the Reporting plan and above, alongside the other Article 14 filing capabilities.

The portal does not schedule publication. To align the advisory with a patch release or an embargo date, publish it yourself on that date.