Tag
vulnerability-management
- May 3, 2026 VEX: Encoding Exploitability So a Scanner Can Stop Guessing A CVE in an SBOM is not a finding. VEX records whether a product is affected and why, with a justification token that a machine can act on and a human can audit. security
- Feb 26, 2026 Advisory Ranges, Reachability, and Deciding a Vulnerability Does Not Matter How advisory databases express which versions are affected, why a version range in an advisory is not the same claim as an exploitable dependency, and what evidence supports suppressing a finding. software engineering