> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/view-and-understand-cve-findings.md). # View and understand CVE findings Review CVE vulnerability findings and their affected software packages. The **Findings** tab on the **Vulnerabilities** page lists raw CVE findings. It includes findings from all monitored repositories and package ecosystems. The **Issues** tab shows findings that match a policy. The **Findings** tab shows every detected CVE, regardless of policy status. ## Workflows Use the **Findings** tab to: * **Audit scanner coverage:** Verify detection across repositories and package ecosystems. * **Identify policy gaps:** Compare findings with issues and create policies for high-risk findings. * **Review excluded findings:** Confirm exclusions do not suppress critical CVEs. * **Validate detection rules:** Investigate false positives by ecosystem or dependency type. {% hint style="info" %} ### Note Findings are raw scanner output. They have no status, SLA, or assignee. Create or update a unified policy to track a finding as an issue. {% endhint %} The CVE findings inventory includes the following attributes. Use the **Table Settings Menu** to show additional properties. | Field/attribute | Description | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CVSS Severity | The CVSS severity level assigned to the finding. | | CVE | The Common Vulnerabilities and Exposures identifier. | | CVSS Score | The CVSS severity score. | | EPSS Score | The probability that exploitation occurs within 30 days. | | Name | The CVE identifier. | | Package Manager | The package management system, such as npm, Maven, or pip. | | Asset Name | The affected asset. Select it to open its side card. | | Risk Factors | Risk attributes: **Found in history**, **Valid**, and **Privileged**. | | Dependency Type | Whether the dependency is direct or transitive. | | Repository | The repository containing the affected asset. | | Branch | The branch or version containing the finding. | | File Path | The finding location in the repository. | | Data Source | The version control system providing the finding. | | Scanner | The scanner that detected the finding. | | Backlog Status | Whether the finding is pre-existing (**Backlog**) or recently introduced (**New**). For classification details, see [SCA vulnerability issues](/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md). | ## Investigate findings Select a finding in the inventory table to open the **Findings** side card. * **Finding summary:** The finding ID and type. CVE findings have type **Vulnerability**. * **Description:** The finding description and location. * **Impact:** The potential risk to your environment. * **Timestamp:** When the finding was last updated. * **Asset details:** The affected **Asset** and **Asset Type**. Select the asset to open its side card. * **Evidence:** Finding context from your software development lifecycle. * **Finding source** * **Data Source:** The system or integration that provided the finding. Select its icon to open it. * **Run ID:** The scan execution identifier. * **Code context** * **Repository:** The repository containing the finding. * **Package Manager:** The package manager that declared the component. * **Branch:** The branch containing the finding. * **File Path:** The finding location within the repository. * **First Hash:** The first commit hash that introduced or detected the finding. * **First Commit Date:** When the problematic dependency was introduced. * **Root Package Name:** The primary component analyzed by the scan. * **Root Package Version:** The analyzed primary component version. * **CVE Information** * **CVE ID:** The public vulnerability identifier. * **CVE Description:** A summary of affected products, impact, and exploitation methods. * **CVSS Severity:** The qualitative CVSS rating. * **CVSS Score:** The CVSS score from 0 to 10. * **EPSS Score:** The probability of exploitation within 30 days. * **Fix Version:** The vendor version that resolves the vulnerability. * **Vendor Link:** The vendor advisory, patch, or documentation URL. * **Risk Factors:** Attributes that affect likelihood or impact. * **Traced Runtime Findings:** Vulnerabilities detected in your running application. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues/view-and-understand-cve-findings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.