Manage vulnerabilities

The Vulnerabilities page consolidates results across scans and applications so you can manage remediation status.

Filter the list

Filter by application, platform, severity, status, priority, owner, due date, detection date, or keyword. A useful first pass is:

1. Critical and High
2. Status is Open
3. Priority is P0 or P1
4. Overdue or unassigned

Review details

Open a vulnerability and review:

• Impact and summary: What could happen
• Evidence: Code, configuration, or strings that triggered the finding
• Remediation: Recommended mitigation
• CWE / CVSS / Confidence: Classification, severity, and detection confidence
• Detection history: Scans and platforms where it was found

Do not decide from the title or severity alone. Evaluate the evidence in the context of how the application is actually used.

Triage

Users with write access can update:

Field	Purpose
Status	Open, In progress, Fixed, or Duplicate
Priority	P0 (highest) through P4
Owner	Organization member responsible for remediation
Due date	Date to fix or reassess the issue

Risk acceptance and false positive are not normal status changes. To preserve an auditable decision, submit a risk exception for an organization administrator to approve.

Status guidance

Status	When to use it
Open	Not investigated or no remediation plan yet
In progress	Investigation, remediation, or verification is underway
Fixed	Remediation is complete; confirm it is absent in the next scan
Duplicate	Track under another vulnerability with the same cause and remediation
Risk accepted	An approved, time-bound decision not to remediate an existing issue
False positive	An approved, time-bound decision that the issue does not apply in the real environment

Changing a status to Fixed does not prove technical resolution until you scan a new binary. Review the next scan’s detection history and security gate.

Add comments

Record investigation results, reproduction conditions, remediation pull requests, verified settings, and decision assumptions. Do not include personal data, credentials, private keys, or other secrets.