Practice
Record the number before you repeat it
Amount, source, and date go on the card before the sentence you would say out loud.
tenable.com published this account (2026-09-20): CVE records for Suricata Http2ThreadMultiBuf UAF / DoH2 type-confusion issues published 20 Sep. Vendor 8.0.7 security release was 15 Sep with CVEs then described as pending.
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: CVE records for Suricata Http2ThreadMultiBuf UAF / DoH2 type-confusion issues published 20 Sep. Vendor 8.0.7 security release was 15 Sep with CVEs then described as pending.
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Amount, source, and date go on the card before the sentence you would say out loud.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: CVE-2026-94084 (and related CVE-2026-94083) published for Suricata; vendor 8.0.7 already shipped Sep 15.