Vulnerabilities & scanning

How scanning works

A scan matches your components against known-vulnerability data and enriches each match with real-world risk signals. Scans run automatically when a BOM is ingested; you can also trigger one on demand.

Enrichment adds two signals that cut through CVE noise:

• KEV — CISA's Known Exploited Vulnerabilities catalog. If a vulnerability is in KEV, it's being exploited in the wild right now.
• EPSS — a 0–1 probability that a vulnerability will be exploited soon.

The Vulnerabilities view ranks findings by severity, KEV, and EPSS so the short list of "fix this first" is obvious.

Scan on demand

Use Scan now on a project to re-scan immediately — handy after a new advisory or KEV update, without waiting for the next upload.

Scan policy

Each project has a scan policy (Project settings → Scans) controlling how and when scans run. Set it once per project and let new uploads inherit it.

Try it

This is the Vulnerabilities view with sample data. Filter by severity and watch the ordering — KEV-flagged and high-EPSS findings rise to the top, exactly as in the product. If you're signed in, "Open in app" takes you to your real data.

Next

Found something real? Triage & decisions covers VEX, exclusions, and applicability rules.