A CVE is a starting point.
Build the patch decision.
New to vulnerability triage? Check the public signals, record what is unknown and prepare a clear owner handoff.
Start with the findings
CVE identifiers or a scanner CSV. Everything you enter stays in this browser tab.
No input loaded. No accounts, remote lookups or model calls.
Your review: add the finding, confirm what runs, then record the owner and next action. See a completed ticket example.
Your evidence worksheet
0 CVEs in this worksheet
Public facts appear here alongside your component, exposure, owner and next action. Applicability begins as unknown.
Notes live only in this tab and are lost on reload. Export before leaving. The export includes source provenance and your unredacted notes.
Built for the handoff after a scan.
A dependency finding can identify a package without proving how it runs. Record the deployed version, reachable feature, access controls and the evidence behind your decision.
Work through the MLflow exampleMake unknowns visible.
An absent score is missing data. A CVE absent from KEV is not a clean bill of health. Keep those distinctions in the report you give the service owner.
Prepare a scanner export