Tag

VEX and vulnerability status

4 guides tagged VEX and vulnerability status, grouped by topic, with the SDLC phase and role each is written for.

Application security

1 guide

Publish security advisories with CSAF, VEX, CVE records and OSV

What a useful security advisory contains and how to publish it in the formats tools read: a validated CSAF 2.0 VEX document, the CSAF provider files, CVE records through a CNA (CVE Record Format 5.2), and OSV records for open-source packages. Covers the status of CSAF 2.1 as of October 2026.

Maintenance · Developers, AppSec engineers

Software supply chain

2 guides

Guide · Software supply chain

Triage new dependency vulnerability findings

Turn a weekly batch of Dependabot, OSV-Scanner or npm audit findings into a short list of distinct, shipped, reachable issues, each routed to one outcome: fix, not affected, accept or escalate.

Development, Maintenance · Developers, AppSec engineers

Guide · Software supply chain

Use VEX without losing vulnerability evidence

Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.

Release, Maintenance · AppSec engineers

Governance & frameworks

1 guide

Guide · Governance & frameworks

Prioritize vulnerabilities by exploitation, exposure and impact

Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.

Maintenance, Security program · AppSec engineers, Security leaders

All tags, lifecycle stages and roles