Vulnerabilities
Exposure › Vulnerabilities lists the vulnerabilities found in your project with their CVE, CVSS, EPSS and KEV, each with the findings behind it.
Read the list
| Column | What it tells you |
|---|---|
| Identifier | The CVE number, where the vulnerability has one. |
| Severity, CVSS | How serious it is rated. |
| KEV, EPSS | KEV marks one listed as known to be exploited; EPSS is how likely exploitation is. |
| Exploitable, Patchable | Whether a known exploit is recorded for it, and whether a patch is. |
CVSS, Exploitable and Patchable are hidden at first; turn them on under View.
Narrow the list
Use the search box and the Severity, Exploited, Exploitable, Patchable and Tags filters. Reset clears them.
Open a vulnerability
- Select a row, or open its menu and choose View Detail.
- Read the identifier, scores, threat status, recommendation and references.
- Choose View Findings from the row menu to see the findings behind it. The same menu has Edit Tags and Delete.
To see one asset's vulnerabilities, choose View Vulnerabilities on its row in Assets › Inventory.
Triage and tag
Tick rows and choose Edit tags, Edit fields, Triage findings or Delete selected. Triage findings applies one status to the findings of the selected vulnerabilities; see Triage a finding. Deleting a vulnerability deletes its findings with it.
Did this answer your question?
Findings
Exposure › Findings is your project's worklist of findings, one weakness on one asset each, to triage, change in bulk and export.
Add or import findings
A finding enters your project by hand, from a vulnerability library write-up, or from a Nessus, Burp Suite, Nuclei, SARIF or JSON report produced by your own tools.