Assess your vulnerabilities
Use this page to understand the impact, severity, and relevance of a vulnerability before taking action. Reviewing vulnerability details helps you determine whether an issue affects your environment and how urgently it needs remediation.
This makes it easier to distinguish between vulnerabilities that require immediate fixes and those that can be addressed through routine maintenance.
To assess a vulnerability
In the Software Trust menu, go to Secure releases.
Select the Security alerts tab.
Select the vulnerability ID you want to review.
Review:
Field
Description
How this helps you
CVE ID
A unique identifier for the vulnerability.
Confirms you are reviewing the correct issue, helps you search external advisories or internal tickets, and serves as the primary reference for tracking and remediation.
Current severity
A qualitative severity rating (for example, Medium).
Provides a quick signal to help you prioritize which vulnerabilities to review first.
Description
A summary of what the vulnerability is and how it can be exploited.
Helps you determine whether your application uses the affected functionality in a way that could be exposed to untrusted input.
Select Show more under Description to review the fields:
Field
Description
How this helps you
CVSS score
A numerical severity score based on the CVSS standard.
Allows more precise comparison across vulnerabilities when prioritizing remediation.
CVSS vector
A breakdown of the factors used to calculate the CVSS score.
Helps you understand why the score is what it is, such as whether user interaction or elevated privileges are required.
Release version affected
The versions of the software that contain the vulnerability.
Helps you determine whether your current version is vulnerable.
Fix version
The version that resolves the vulnerability.
Helps you identify the version to upgrade to. If you are already running this version or later, the vulnerability may not require action.
Impact
Describes how the vulnerability can be exploited and the effect it has on affected systems, including technical details such as attack vectors and outcomes (for example, denial of service through excessive resource consumption).
Helps you understand the real-world risk and potential damage, so you can prioritize remediation based on severity and exposure.
Patches
Lists the software versions or updates where the vulnerability has been fixed, along with guidance on which versions to upgrade to.
Enables you to quickly identify the correct remediation path and ensure affected systems are updated to secure versions.
Workarounds
Provides mitigation steps that reduce risk when an immediate upgrade is not possible, such as configuration changes or input restrictions.
Helps you temporarily protect systems and reduce exploitability while planning or scheduling a full fix.
Resources
Includes supporting materials such as repositories, related vulnerabilities, technical references, or documentation relevant to the issue.
Gives you additional context and technical depth for investigation, validation, or communication with stakeholders.
Evidence
Expand to review:
Web references
Advisory sources
Package / Repository
Fix / Patch (commit)
Helps you verify the vulnerability, understand its origin, and support audit, compliance, or incident response efforts.
Web references
Links to security research, public disclosures, or technical write-ups.
Allows you to validate details and gather additional technical context.
Advisory sources
Links to official vulnerability advisories, such as NVD entries.
Helps you confirm severity, remediation guidance, and authoritative details.
Package / Repository
Links to the affected project’s source code or package repository.
Helps you explore the affected codebase and understand where the vulnerability exists.
Weakness
A classification of the underlying software weakness that led to the vulnerability.
Provides high-level context, helps identify patterns across vulnerabilities, and informs longer-term remediation or coding improvements.
Review the Detection timeline.
Displays when the vulnerability was first detected, and every other detection within a specific repository.