Yes, We use our own database. The data comes from Public disclosure vulnerabilities as well some of privately reported vulnerabilities from internal sources.