Docs

What a sighting must contain, and what the validator checks. The field reference is generated from the schema files when the site is built, so it cannot drift from what the validator enforces. Submit a sighting covers the mechanics of filing one.

What tier you can claim

Your claimed_tier is a hint. A reviewer grades the evidence against the rubric and records review.accepted_tier, which is often lower. That is normal. It is not a rejection.

This table says what each kind of evidence supports, and what it does not.

Two timestamps

This is the most common mistake. observed_at is when the activity happened. reported_at is when it was written up.

Use the observation time. It drives every date on the entry, including first_sighting, and first_sighting is the number embargo arguments turn on. A sighting seen on 17 October and written up on 22 October is dated 17 October.

How a sighting is structured

One observation submitted by a reporter. Sightings are the only thing contributors write; entries are derived from accepted sightings. Leave review out of your submission. Core writes it.

This table lists every field, nested ones with a dotted path.

The conditional requirements

A required column cannot show these, and they are the ones people get wrong. The first rows come from the schema. The rest are checks the validator makes beyond it.

What gets rejected before a human sees it

Every string in the record is scanned, in every field. A match rejects the whole record before a person reads it. The record is rejected if any string in it contains one of these.

• A PHP open tag.
• A call to eval.
• A long run of base64-style characters, more than 200 in a row.
• A download piped straight into a shell.
• A recursive delete chained onto another command.
• A shell invoked with a command string.

This is deliberate and blunt. It catches payloads regardless of intent, so it will occasionally reject something harmless. If you think a rejection is wrong, say so in the pull request. Do not reword the string to get past the check.

Send hashes, header names, path patterns, aggregated volumes and links to published detection rules instead.

A worked example

SIGHT-CVE-2026-109618-0006 claimed confirmed and was accepted at attempts. It is a real record, read from the registry when this page was built.

{
  "schema_version": "1.0",
  "id": "SIGHT-CVE-2026-109618-0006",
  "cve": "CVE-2026-109618",
  "reporter": {
    "org": "[WordPress security vendor]",
    "handle": "threat-intel",
    "contact_hash": "sha256:0000000000000000000000000000000000000000000000000000000000000006",
    "role": "trusted-reporter"
  },
  "observed_at": "2026-10-21T07:34:00Z",
  "reported_at": "2026-10-21T08:05:00Z",
  "claimed_tier": "confirmed",
  "evidence_type": "third-party-report",
  "fingerprint": {
    "runtime": "php",
    "version": "unknown",
    "sapi": "mod_php",
    "server": "apache",
    "app": "wordpress"
  },
  "volume": {
    "count": 6,
    "unique_sources": 3,
    "window_hours": 4
  },
  "outcome": "unknown",
  "summary": "Hosting partners reported multiple active exploitation incidents several hours before the scheduled release. No incident response artifacts shared with the Observatory; reports relayed second-hand.",
  "source_url": "https://example.invalid/wp-vendor-post",
  "signature": "sigstore:PLACEHOLDER",
  "review": {
    "status": "accepted",
    "reviewer": "core/asmith",
    "accepted_tier": "attempts",
    "rubric_row": 8,
    "note": "Claimed confirmed. Third-party report without first-hand artifacts supports attempts at most. Reporter asked to forward partner IR artifacts if available.",
    "reviewed_at": "2026-10-21T09:12:00Z",
    "recusals": []
  }
}

Why it graded lower:

• Evidence type: third-party-report.
• Rubric row 8: Third-party report of a compromise with no first-hand access Supports up to attempts, with source_url. Does not support confirmed.
• Reviewer note: Claimed confirmed. Third-party report without first-hand artifacts supports attempts at most. Reporter asked to forward partner IR artifacts if available.

The fingerprint

A tier belongs to a configuration. The same CVE can be validated against one SAPI and server pair and fail against another, and the entry shows both. The fingerprint is how a tier comes to mean something to a specific operator.

Describes the deployment an observation applies to. Sightings group by runtime, sapi, server and config_flags. The group id is the sha256 of those fields as canonical JSON, first 12 hex chars, prefixed 'fp-'. An unknown value counts as missing and never forms a group of its own.

Be exact. A vague fingerprint puts the sighting in the wrong group, or in none, and the operator running that stack reads a tier that does not describe them. Write unknown only when you do not know. Do not guess.