portstatus shows, for every FreeBSD port, whether its CVEs have been dealt with. Only CVEs that affect a port are considered. Each CVE has exactly one of three states:

unaddressed

The CVE record lists the package version as affected and no VuXML entry names the CVE for this package. A VuXML entry or an update is missing.

VuXML only

A VuXML entry exists, but the package version is still within the affected range. pkg audit reports the package.

fixed

The package version is no longer within the affected range of the VuXML entry.

likely backported

No VuXML entry, but the CVE record only gives a range ending in a newer branch (for example “before 3.3.6”) and the port is an older branch whose current version was released after the CVE, so the branch is still maintained. Such fixes are usually backported; check the branch changelog. Not counted as unaddressed.

Versions are compared like pkg version -t. Commits are picked up every minute, VuXML hourly, everything else daily.