How PatchBell verifies versions and sources
Where each fact comes from, and what is shown when a source is silent.
Official sources only
Facts come from the project itself, the CVE numbering authority, a distribution's own tracker or advisory, and the vendor's own status page. Blog posts and forum threads are never a source for a version.
Upstream fixes need two sources
A fixed upstream release is shown only when two independent official sources agree. With one source it is shown as unconfirmed.
Versions are copied, not rounded
Every version string appears exactly as the source prints it. A version is never inferred from a neighbouring one.
Unknown is not fixed
If a distribution or host has made no statement, the row says so. It is never shown as fixed.
Dates
Each record shows when it was last checked. When a record is older than its refresh window, the page says so.