Reference B: Objective condition filters

The condition defines which vulnerability issues a vulnerability objective tracks. Vulnerability objectives evaluate vulnerability issues only. Condition filters divide into common filters (available for both repositories and container images), code-only filters, and image-only filters.

Common vulnerability filters

Condition filter	Description
Exploitable	The vulnerability is on the CISA KEV list.
CVE ID	The vulnerability CVE identifier.
CVSS Severity	The CVSS severity: Critical, High, Medium, or Low.
CVSS	The CVSS score.
EPSS	The EPSS score.
Has A Fix	A fix is available for the vulnerability.
Package Version	The affected package version.
Package Name	The affected package name.
CVE Risk Factors	The risk factors associated with the CVE.
Fix Versions	The versions that resolve the vulnerability.

Code-only filters

Condition filter	Description
Package Popularity	The popularity of the package: High, Medium, or Low.
Package Deprecated	The package is deprecated.
Package Maintained	The package is maintained.
Package Operational Risk	The operational risk of the package: High, Medium, or Low.
Repository File Path	The file path within the repository.
Package Dependency	The dependency type: Direct or Transitive.
Is AI/ML	The package is an AI/ML package.

Image-only filters

Condition filter	Description
Base Image Vulnerability	The vulnerability is derived from the base image.
Image File Path	The file path within the image.
Is Root	The image runs as root.
Package PURL	The package URL (PURL).
Package Type	The package type.