Skip to main content

Find and triage vulnerabilities

Use the organization Vulnerabilities page when you need to decide what to fix first across projects. Open a project when you need findings for one repository, one build, or one Generic project's uploaded SBOMs.

One finding per component​

Each vulnerability row is one finding: one affected component and one CVE (or advisory). The same CVE on two components appears as two rows, and you can triage each finding separately. Organization and project summary counts, Build Comparison, and Top priority projects use that same component×CVE granularity—not one row per CVE across all packages.

On an SBOM report, the Vulnerabilities tab uses the same one-finding-per-component shape.

Start with the highest-priority findings​

  1. Open Vulnerabilities at organization scope.
  2. Use the summary cards for Known Exploited Vulnerabilities and Critical and High Vulnerabilities, including how many findings RunSafe mitigates and how many have fixes available.
  3. Use Top priority projects to open the projects or uploaded SBOM sources with the most critical, high, or known-exploited findings.
  4. In the table, filter or sort from the table controls. Known-exploited and high-scoring findings appear first by default.
  5. Select the view icon on a row to open that finding's SBOM report.

What the organization list includes​

For each enabled SCM-backed project, the organization page includes findings from the latest complete Build on the project's default branch. It also includes every complete manually uploaded SBOM in the organization, including multiple uploads for the same Generic project.

To inspect findings for a non-default branch:

  1. Open the project from Projects.
  2. Open Builds and select the Build you need.
  3. Use that Build hub's Vulnerabilities view, or open the project's Vulnerabilities page only when you want the default-branch summary.

Generic projects summarize the latest uploaded SBOM data instead of a Build.

Triage Carry-Forward​

When a new scan finds a vulnerability that you already triaged on a matching earlier scan, the Platform carries forward the previous state for that finding. Matching uses the same connected project, git ref, SBOM file path, language context, and affected component (preferring the component's bom-ref, and using package URL only when it uniquely identifies the prior finding).

That keeps decisions such as Resolved, Not affected, or False positive when the SBOM for the same branch is regenerated, without applying one component's triage to a different package that shares the same CVE.

Automatic triage for compiled C/C++ components​

For SBOMs produced by the RunSafe C/C++ SBOM generator, the Platform can mark some findings Not affected when the CVE description names source files that are not present in the SBOM.

Automatic triage applies only to CycloneDX components tagged as compiled (the generator sets a compiled component tag). Components without that tag stay open for human triage so vulnerabilities in uncompiled or incomplete binary context are not dismissed automatically.

How triage changes pipeline checks​

Vulnerability compliance checks count findings that are not triaged, marked Exploitable, or still In triage. Findings triaged as Resolved, Not affected, or False positive do not count toward critical/high or known-exploited thresholds. See thresholds for more details.