> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medisao/follow-security-advisories.md).

# Follow security advisories

**Advisories** lists security advisories that affect medical devices and healthcare systems, with the most recently updated first. Each advisory links to its full source, and each is marked with a Traffic Light Protocol (TLP) level that tells you how widely you can share it.

## Before you begin

* Your organization's plan must include MedISAO.

## Browse advisories

1. In the sidebar, select **Advisories**. The **Security Advisories** page opens.
2. Review the table:

   | Column           | What it shows                                                                                         |
   | ---------------- | ----------------------------------------------------------------------------------------------------- |
   | **NAME**         | The advisory title. If the advisory has a source page, the name is a link that opens it in a new tab. |
   | **TLP LEVEL**    | How widely the advisory can be shared (see below).                                                    |
   | **LAST UPDATED** | When the advisory last changed.                                                                       |
   | **ACTIONS**      | Expand or collapse the advisory's description.                                                        |
3. To read an advisory's summary without leaving the page, select the arrow in **ACTIONS** (**Show description**). Select it again to hide it.
4. To open the full advisory, select its **NAME**.
5. To reorder the list, select a column heading. For example, select **TLP LEVEL** to group advisories by sharing level, or **LAST UPDATED** to switch between newest and oldest first.

If no advisories are available to you, the page shows **No Security Advisories**.

## Understand TLP levels

The Traffic Light Protocol (TLP) is a widely used standard for marking how far a piece of security information can be shared. Every advisory carries one of these levels:

| TLP level                 | Meaning                              | What you can do with it                                                        |
| ------------------------- | ------------------------------------ | ------------------------------------------------------------------------------ |
| **TLP:WHITE (Public)**    | Public information.                  | Share freely.                                                                  |
| **TLP:GREEN (Community)** | For the MedISAO community.           | Share with peers and partners in the community, but don't publish it.          |
| **TLP:AMBER (Limited)**   | Limited disclosure.                  | Share only within your organization, and with others who need it to act on it. |
| **TLP:RED (Restricted)**  | Restricted to named recipients only. | Don't share it beyond the people it was given to.                              |

{% hint style="info" %}
You see only advisories your access allows. Public advisories are visible to everyone. Members of an organization whose plan includes MedISAO also see community and limited advisories. If you expected to see an advisory and it isn't listed, ask your organization admin whether your plan includes MedISAO.
{% endhint %}

## Act on an advisory

An advisory tells you that a problem exists. To work out whether it affects your devices:

1. Open the advisory's source page from **NAME** and note the CVE IDs and the affected products or versions.
2. Look up each CVE in **CVE Search** to see its severity, CVSS metrics, and AI-generated update and mitigation guidance.
3. If the advisory names a vendor or component rather than specific CVEs, look it up in **Product Search**.

## Next steps

* [Search CVEs and check impact on your devices](/medisao/search-cves-and-check-impact.md): look up the CVEs an advisory mentions.
* [Search for a product's vulnerabilities](/medisao/search-for-a-products-vulnerabilities.md): check every CVE recorded against a named product.
* [Share advisories and remediations through VIPER channels](/medisao/share-through-viper-channels.md): publish your own advisories for the hospitals that run your devices.