View Vulnerabilities

The Vulnerabilities page displays all detected vulnerabilities across your assets. Use it to assess your exposure, prioritize remediation, and track resolution progress.

Accessing the Vulnerabilities Page

Navigate to Vulnerabilities in the left menu. The page loads all open vulnerability findings.

Summary Cards

At the top of the page, six clickable summary cards provide an at-a-glance view:

Card	Description
Critical (red)	Number of critical-severity vulnerabilities (CVSS 9.0+)
High (orange)	Number of high-severity vulnerabilities (CVSS 7.0-8.9)
Medium (yellow)	Number of medium-severity vulnerabilities (CVSS 4.0-6.9)
Low (blue)	Number of low-severity vulnerabilities (CVSS 0.1-3.9)
CISA KEV (red)	Number of vulnerabilities in the CISA Known Exploited Vulnerabilities catalog
Total Open (gray)	Total number of open (unresolved) vulnerabilities

Click any card to filter the table by that severity or category. Click Total Open to clear the filter.

A secondary indicator shows the total number of affected assets across all vulnerabilities.

Vulnerability Table

The main table lists each vulnerability finding with the following columns:

Column	Sortable	Description
Severity	Yes	The severity level badge: Critical, High, Medium, or Low
CVE / OSV ID	Yes	The vulnerability identifier. Click to open the detail page.
Asset	Yes	The affected asset name. Click to navigate to the asset detail page.
Package	Yes	The vulnerable package name and its ecosystem (e.g., npm, Debian, PyPI)
Version	Yes	The installed version of the vulnerable package
CVSS	Yes	The CVSS v3.1 score (0.0 -- 10.0). Color-coded by severity.
EPSS	Yes	The EPSS exploitation probability as a percentage
Risk	Yes	The composite risk score (0.0 -- 10.0). Color-coded by severity.
KEV	No	A KEV badge if the vulnerability is in the CISA KEV catalog
Status	No	Open (red) or Resolved (green)
Detected	Yes	When the vulnerability was first detected
Actions	No	View button to open the vulnerability detail page

Search

Use the search bar to filter vulnerabilities by:

• CVE ID: Search for a specific CVE (e.g., "CVE-2024-1234")
• OSV ID: Search by OSV identifier
• Package name: Find vulnerabilities for a specific package
• Asset name: Find all vulnerabilities on a specific asset
• Ecosystem: Filter by package ecosystem (e.g., "Debian", "npm")

Filter by Severity

Click a summary card to filter the table:

1. Click Critical, High, Medium, or Low to filter by CVSS severity
2. Click CISA KEV to show only vulnerabilities with confirmed active exploitation
3. A filter badge appears showing the active filter
4. Click the X button next to the badge to clear the filter

Sort

Click any sortable column header to sort:

• Click once for ascending order
• Click again for descending order

TIP

Sort by Risk descending to see the most exploitable and impactful vulnerabilities first. The risk score combines CVSS severity, EPSS exploitation probability, and KEV status into a single prioritization metric.

Common Workflows

Prioritize Critical Remediation

1. Click the Critical summary card
2. Sort by EPSS descending to identify which critical vulnerabilities are most likely to be exploited
3. Focus on entries with a KEV badge first: these are known to be actively exploited

Assess a Specific Asset's Exposure

1. Search for the asset name in the search bar
2. Review all vulnerabilities affecting that asset
3. Sort by Risk to prioritize remediation

Track CISA KEV Vulnerabilities

1. Click the CISA KEV summary card
2. All entries shown are vulnerabilities with confirmed active exploitation
3. These should be treated as the highest priority for remediation

Find Outdated Packages

1. Search by package name
2. Review the installed version versus the available fixed version (visible on the detail page)
3. Plan package updates across affected assets

Related Pages

• Understanding Vulnerabilities: How vulnerability detection works
• Vulnerability Detail: Deep dive into a specific vulnerability
• EPSS and KEV: Exploitation scoring and known exploits