Vulnerability Findings

This is the help text the console shows in the help panel on this page.

Vulnerability Findings is your triage queue for known vulnerabilities (CVEs) found in the components of your uploaded SBOMs. It lists findings from all your SBOMs in one table. The list is refreshed by a nightly match against the NVD and Red Hat feeds.

Triage Workflow

• Filter: Search by CVE ID, or filter by Status and Severity (Critical, High, Medium, Low).
• Table: CVE ID, Severity, Status, Component, SBOM and First seen.
• Triage: Click Triage on a row to set the status and write remediation notes. Statuses: Open, Mitigated, Accepted Risk, False Positive, Fixed.

Decision Documentation

• Accepted Risk: Record why a vulnerability won’t be fixed (for example, the vulnerable code is unreachable) in the remediation notes.
• False Positive: Mark incorrect matches so they stop cluttering the list.
• Workaround: Use Mitigated and describe the workaround in the notes.