# Field Manual: security in plain English

Plain-English explainers for the terms in every security bulletin: CVEs, CISA KEV, zero-days, CVSS, supply chain attacks, prompt injection and more.

- Web page: https://codemarine.ai/learn/

## The basics

The words on every bulletin.

- [CVE](https://codemarine.ai/learn/wtf-is-a-cve.md): A CVE is a public ID for one specific security flaw, so everyone knows they are talking about the same bug.
- [CVSS](https://codemarine.ai/learn/cvss-severity.md): CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you.
- [Patch and advisory](https://codemarine.ai/learn/patch-and-advisory.md): An advisory tells you what is broken and which versions are hit. A patch is the fix.

## Under attack

What it means when the shooting starts.

- [CISA KEV](https://codemarine.ai/learn/cisa-kev.md): The KEV catalog is the US government list of security flaws with reliable evidence of real attacks.
- [Exploited in the wild](https://codemarine.ai/learn/exploited-in-the-wild.md): Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab.
- [Zero-day](https://codemarine.ai/learn/zero-day.md): A zero-day is a flaw that gets attacked while it is still unknown, so defenders had no warning.
- [Indicators of compromise](https://codemarine.ai/learn/indicators-of-compromise.md): Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain.
- [RCE and privilege escalation](https://codemarine.ai/learn/rce-and-privilege-escalation.md): RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside.

## AI agent threats

What your coding agent reads, installs and runs.

- [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md): A supply chain attack reaches you through something you already trust, like a package, extension or update.
- [Prompt injection](https://codemarine.ai/learn/prompt-injection.md): Prompt injection is when text an AI reads tricks it into following an attacker instead of you.
- [MCP server](https://codemarine.ai/learn/mcp-servers.md): An MCP server plugs outside tools and data into an AI agent, and those tools can do real things.

## Life of a bug

1. **Flaw found:** Someone spots a security flaw in a product.
2. **CVE assigned:** A CVE Numbering Authority gives it an ID, so everyone means the same bug.
3. **Advisory:** The official notice: what is broken and which versions are hit.
4. **Patch:** The update that repairs the flaw. Attackers read advisories too.
5. **Exploited, added to CISA KEV:** Attackers hit real targets. With reliable evidence and a clear fix, it goes on the list.
6. **You patch:** Move to the fixed version, then check for signs of compromise.

Real bugs do not always march in this order. A zero-day is attacked before any fix exists, and plenty of bugs never reach step 5.

## CVSS severity scale

| Rating | CVSS score |
| --- | --- |
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |

## For agents

- Term data: https://codemarine.ai/learn.json
- Every entry in full: https://codemarine.ai/llms-full.txt
- Search the hub: https://codemarine.ai/learn/?q=your+term