View and understand CVE findings

Review the findings associated with CVE vulnerability issues.

Review CVE vulnerability findings and their affected software packages.

The Findings tab on the Vulnerabilities page lists raw CVE findings. It includes findings from all monitored repositories and package ecosystems.

The Issues tab shows findings that match a policy. The Findings tab shows every detected CVE, regardless of policy status.

Workflows

Use the Findings tab to:

• Audit scanner coverage: Verify detection across repositories and package ecosystems.
• Identify policy gaps: Compare findings with issues and create policies for high-risk findings.
• Review excluded findings: Confirm exclusions do not suppress critical CVEs.
• Validate detection rules: Investigate false positives by ecosystem or dependency type.

Note

Findings are raw scanner output. They have no status, SLA, or assignee.

Create or update a unified policy to track a finding as an issue.

The CVE findings inventory includes the following attributes. Use the Table Settings Menu to show additional properties.

Field/attribute	Description
CVSS Severity	The CVSS severity level assigned to the finding.
CVE	The Common Vulnerabilities and Exposures identifier.
CVSS Score	The CVSS severity score.
EPSS Score	The probability that exploitation occurs within 30 days.
Name	The CVE identifier.
Package Manager	The package management system, such as npm, Maven, or pip.
Asset Name	The affected asset. Select it to open its side card.
Risk Factors	Risk attributes: Found in history, Valid, and Privileged.
Dependency Type	Whether the dependency is direct or transitive.
Repository	The repository containing the affected asset.
Branch	The branch or version containing the finding.
File Path	The finding location in the repository.
Data Source	The version control system providing the finding.
Scanner	The scanner that detected the finding.
Backlog Status	Whether the finding is pre-existing (Backlog) or recently introduced (New). For classification details, see SCA vulnerability issues.

Investigate findings

Select a finding in the inventory table to open the Findings side card.

• Finding summary: The finding ID and type. CVE findings have type Vulnerability.
• Description: The finding description and location.
• Impact: The potential risk to your environment.
• Timestamp: When the finding was last updated.
• Asset details: The affected Asset and Asset Type. Select the asset to open its side card.
• Evidence: Finding context from your software development lifecycle.

  • Finding source

    • Data Source: The system or integration that provided the finding. Select its icon to open it.
    • Run ID: The scan execution identifier.
  • Code context

    • Repository: The repository containing the finding.
    • Package Manager: The package manager that declared the component.
    • Branch: The branch containing the finding.
    • File Path: The finding location within the repository.
    • First Hash: The first commit hash that introduced or detected the finding.
    • First Commit Date: When the problematic dependency was introduced.
    • Root Package Name: The primary component analyzed by the scan.
    • Root Package Version: The analyzed primary component version.
  • CVE Information

    • CVE ID: The public vulnerability identifier.
    • CVE Description: A summary of affected products, impact, and exploitation methods.
    • CVSS Severity: The qualitative CVSS rating.
    • CVSS Score: The CVSS score from 0 to 10.
    • EPSS Score: The probability of exploitation within 30 days.
    • Fix Version: The vendor version that resolves the vulnerability.
    • Vendor Link: The vendor advisory, patch, or documentation URL.
    • Risk Factors: Attributes that affect likelihood or impact.
• Traced Runtime Findings: Vulnerabilities detected in your running application.