# Vulnerability Findings
URL: https://docs.autociso.io/console/supply-chain/findings/
Description: Vulnerability Findings is your triage queue for known vulnerabilities (CVEs) found in the components of your uploaded SBOMs. It lists findings from all your SBOMs in one table.

*This is the help text the console shows in the help panel on this page.*

Vulnerability Findings is your [triage queue](https://docs.autociso.io/api/reference/sboms/list/) for known vulnerabilities (CVEs) found in the components of your [uploaded SBOMs](https://docs.autociso.io/console/supply-chain/sboms/). It lists findings from all your SBOMs in one table. The list is refreshed by a nightly match against the NVD and Red Hat feeds.

### Triage Workflow
- **Filter**: Search by CVE ID, or filter by **Status** and **Severity** (Critical, High, Medium, Low).
- **Table**: CVE ID, Severity, Status, Component, SBOM and First seen.
- **Triage**: Click **Triage** on a row to [set the status](https://docs.autociso.io/api/reference/findings/update-status/) and write remediation notes. Statuses: **Open**, **Mitigated**, **Accepted Risk**, **False Positive**, **Fixed**.

### Decision Documentation
- **Accepted Risk**: Record why a vulnerability won't be fixed (for example, the vulnerable code is unreachable) in the remediation notes.
- **False Positive**: Mark incorrect matches so they stop cluttering the list.
- **Workaround**: Use **Mitigated** and describe the workaround in the notes.