It's based on advisories, so, it also includes vulnerabilities that are not given yet a cve,