|---|---|---|

| vulnerability | `severity` | The OSV schema supports quantitative severity scores such as CVSS. GitHub additionally assigns each vulnerability a non-quantitative human-readable severity value. |

| vulnerability | `cwe_ids` | GitHub assigns each vulnerability at least one Common Weakness Enumeration (CWE) as part of its vulnerability curation process. These IDs map directly to CWE IDs tracked in the [CWE Database](https://cwe.mitre.org/). |

| vulnerability | `github_reviewed_at` | The timestamp of the last review by a GitHub security researcher. |

| range | `last_known_affected_version_range` | The OSV schema does not have native support for all of the potential ways GitHub represents vulnerabile version ranges internally. It is used to track version range information that is not representable in OSV format, or that GitHub needs to be able to track separately from the OSV ranges. This field may appear in addition to or in place of OSV affected range events. See [this comment](https://github.com/github/advisory-database/issues/470#issuecomment-1998604377) a technical explanation. |