Searching every product for one vulnerability
The exposure search checks every active product against one vulnerability identifier. It queries the Open Source Vulnerabilities database and gives one verdict for each product.
You can find the search in the sidebar under CRA compliance, Exposure Search. The feature requires the Compliance plan.
Verdicts
The search returns one of five verdicts for each product.
| Verdict | Key | Description |
|---|---|---|
| Affected | affected | OSV reports a component version in the product SBOM as affected, and no VEX statement clears it |
| Not affected (VEX) | not_affected_vex | Every affected component carries a VEX status of not_affected or fixed |
| Not affected (version) | not_affected_version | The package is in the SBOM with a version, and OSV reports that version outside the affected range |
| Not in SBOM | not_in_sbom | No SBOM component matches an advisory package name |
| Unknown | unknown | The product cannot be checked |
Unknown reasons
A product the search cannot check shows as unknown. The table lists the reasons in check order.
| Reason key | Description |
|---|---|
no_sbom | No SBOM reaches the product |
stale_sbom | The SBOM is more than 90 days old |
no_package_data | The OSV advisory lists no affected package |
lookup_failed | The OSV version check did not answer for this product candidates |
unversioned_components | A matching component has no version, and no other component is affected |
VEX statements
VEX statements recorded on the SBOM settings page can clear an affected component. When an affected component has a VEX status of not_affected or fixed, the search clears that match. If all affected components have a clearing VEX status, the verdict becomes Not affected (VEX). A VEX status of under_investigation or affected does not clear a component.
Limits
The search has two limits.
First, the search checks the SBOM that is current today. It does not check earlier product releases.
Second, the search finds only components that the SBOM lists. Supplier firmware without its own SBOM can show as Not in SBOM.
Starting an Article 14 report from a result
The page shows an exploitation evidence block for the searched vulnerability. It reads the local KEV table, which merges five catalogues. No KEV entry does not mean the vulnerability is not exploited. An advisory with no CVE alias shows Not checked.
An administrator sees a Start Article 14 report button on each affected product.
The created report holds the product, the advisory text, the affected components, the KEV evidence and the draft fields. The draft fields include the title, the CVE identifier and the nature of the vulnerability.
The search does not mark the vulnerability as actively exploited. It does not set the time you became aware. You record that decision on the report page. The Article 14 deadlines start only from that decision.
A second click for the same product and vulnerability opens the existing report. It creates no second report.