Is this CVE real for this package version?

A published CVE can still be disputed, overstated, or wrongly scoped. For each CVE and package version, tots runs two independent investigations: one tests the code in a sandbox, and one collects what maintainers, databases, and vendors have said. A judge model (Jev) scores the evidence, and a fixed policy turns those scores into the label.