For asset-preserving joins, use the inventory explorer and its format guide. This page describes the separate CVE worksheet.
Prepare the scanner export.
This worksheet starts after a scanner or advisory review supplies candidate CVEs. It does not discover packages, check versions or test an endpoint. Google OSV-Scanner already covers dependency-scanning workflows. Preserve the original scanner output in your team's evidence system.
The supported format
Use a comma-separated file with exactly one header named CVE, CVE_ID, CVE ID or CVEs, ignoring case. Quoted cells, doubled quote escapes, Windows line endings and embedded newlines inside quoted cells are supported.
asset,CVE,scanner_note
staging-registry,CVE-2023-1177,Inventory finding only
second-registry,CVE-2023-1177,Needs deployment verification
This imports one unique CVE. The asset and scanner-note columns are ignored. The worksheet records a decision per CVE, not per asset. Use a separate exported worksheet when different deployments require different applicability conclusions.
A CVE cell can contain multiple identifiers separated by spaces, commas or semicolons. Quote cells containing commas. Blank CVE cells are reported as invalid. Unsupported headers and malformed rows fail with an explanation.
Duplicates, errors and limits
Repeated identifiers are merged and reported. Adding a CVE already in the worksheet preserves its notes. Invalid identifiers stop the import, leaving the existing worksheet intact. Correct the input and try again.
Use up to 100 unique CVEs, 2,000 CSV data rows and 128 KiB of input. Filter a large export to the service or change you are reviewing. The tool does not claim to support every vendor's proprietary export schema.
Make the handoff useful
Record the running component and version, reachable feature, owner, next action and evidence reference. If you do not know, leave applicability unknown and write the question that someone needs to answer. A label without its rationale is difficult for the next analyst to evaluate.
Export before leaving
Notes exist only in this tab's memory. Reloading or closing the page loses them. Export the JSON worksheet for the full source metadata, or the text handoff for a ticket draft. Both include your notes without automatic redaction, so review the file before sharing it.
No uploaded content is sent to a remote service. Following an advisory link opens the external publisher and reveals the requested public advisory to that site. See privacy details and the ticket-writing guide.