Vulnerabilities
The Vulnerabilities page lists every unique vulnerability finding across your environment: one row per vulnerability name, with a count of how many distinct devices it affects.
Why grouped by name, not by raw finding
A single CVE found on the same device by two different tools (or across several installed versions of the same software) is one real problem, not two or three. Navigator groups raw findings by vulnerability name so the “affected assets” count reflects distinct devices, not raw rows. Need to compare how two different sources reported the exact same instance? Each grouped vulnerability links out to its raw per-source records for that kind of side-by-side comparison.
Enrichment
Every vulnerability is automatically enriched with data from public feeds, shown inline without needing your own lookup:
- CVSS score and vector, with the reporting source noted
- EPSS: FIRST.org’s exploitation-probability score and percentile
- KEV: flagged when a CVE is on CISA’s official Known Exploited Vulnerabilities list, or VulnCheck’s broader tracked-exploitation list (shown as a flame icon; hover to see which list)
- Description, CWE, and SSVC decision points, where available
This enrichment runs against public data (VulnCheck Community, FIRST EPSS, CISA KEV). It never sends your data anywhere; it only adds public reference information on top of what your own connectors reported.
Filtering and search
Filter by Severity or Source in the facet rail, or use the KEV filter to see only actively-exploited vulnerabilities. The Devices column links directly to a pre-filtered Devices view showing exactly which of your devices are affected.
Known gap: not every field is populated by every source
Some fields depend on what a specific connector reports. For example, cvss_score before enrichment is only set by connectors that report a numeric score natively, and remediation-SLA tracking depends on a “first found” timestamp not every connector’s API exposes. Where a field genuinely isn’t available yet, it’s shown as a dash rather than a fabricated value.