AI-enhanced descriptions, SBOM match details and full CVSS vectors

Released February 28, 2026

CVE pages show an AI-enhanced description, with a switch back to the original text. Elsewhere, SBOM reports name the advisories behind each finding, and bulletin pages spell out the full CVSS vector.

AI-enhanced descriptions on CVE pages

Original CVE descriptions vary a lot. Some explain the impact in plain words, others are a product name and a version range. CVE pages and search results show an AI-enhanced description where one has been generated, and the “Original description” option brings back the source text. When a CVE record changes significantly, its AI description is regenerated.

SBOM findings name their matches

Each CVE in an SBOM report lists the advisories it was matched through. Before acting on a finding, you can check it against its source.

The full advisory on the bulletin page

Bulletin pages used to show a fixed set of CVSS vector components. They now show every component the source publishes. Advisories that come with attachments list them on the page.

Office builds and Linux package data

For Microsoft Office products that MSRC lists without a build number, the fixed builds come from Microsoft’s Office security update list, and LTSC editions of Office and Word are kept apart from regular releases. Red Hat advisories carry structured affected-library data next to the affected packages, and SUSE CVE records list affected packages as data rather than plain strings.