---
title: "Vulnerabilities"
description: "See which CVEs affect the software installed on your endpoints, decide per CVE, and accept a risk on one endpoint with a recorded reason."
url: "https://support.outpostplatform.com/automation/vulnerabilities/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Software > Vulnerabilities matches inventory against distribution security feeds and NVD. Shows advisory sources, distribution severity, fixed versions, and separate unverified and no-fix counts. Agent 0.3.0 supplies Linux package identity. Suppression accepts risk per endpoint with a reason and requires alert:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "vuln:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/vulnerabilities.md"
license: "CC BY 4.0"
---

# Vulnerabilities

Outpost matches installed software against distribution security feeds and the
National Vulnerability Database (NVD) to identify known vulnerabilities, or
CVEs. Matching uses the inventory endpoints already report. Use the findings
to decide what to fix and record risks you accept.

## Before you begin

- To see findings you need `vuln:read`. To suppress a finding you need
  `alert:manage`, because accepting a risk is the same kind of decision as
  silencing an alert.
- On the MSP plan, open the client's workspace first.

## How findings are made

- Linux distribution packages are matched against the distribution's own
  security data from the Debian security tracker and OSV. Native package
  version rules recognize fixes backported by the distribution, even when
  the upstream version number stays the same.
- Feed families include Debian, Ubuntu, AlmaLinux, Rocky Linux, Red Hat, SUSE,
  and Alpine. Verification requires coverage for the exact distribution and
  release. Red Hat and SUSE require an exact product/release match; a related
  distribution is not proof of coverage.
- Other software is matched against NVD, including its applicability
  conditions. Add-ins and plug-ins are assessed as their own products, not
  assigned their host product's CVEs.
- A finding names the CVE, installed software and version, and the fixed
  version when the advisory provides one. Distribution findings use the
  distribution's severity rating when assigned, otherwise NVD's. The CVSS
  score comes from NVD.
- A finding is **open** while the endpoint still reports the matching software,
  and **resolved** when it stops reporting it, for example after an upgrade or a
  removal.
- The profile setting `vuln.scan_enabled`, on by default, decides whether an
  endpoint's software is matched. Turning it off stops new findings for the
  endpoint and does not mark it clean.
- A newly found vulnerability at or above `vuln.alert_min_severity`, which
  defaults to `high`, raises an alert. Findings below it are still recorded and
  listed. See the [Vulnerability settings](/automation/policy-settings/#vulnerability).

Distribution package identity requires agent 0.3.0 or later. Older agents'
Linux package findings are not distro-verified. Outpost picks up a newly
reported distribution release within about 15 minutes of the first endpoint
reporting it, when feed coverage is available. Findings refresh on the next
scan.

If the page shows **The vulnerability feed is not switched on**,
[contact support](/support/contact/). Existing findings stay listed.

## Review vulnerabilities

1. Go to **Software** > **Vulnerabilities**.

   The list has one row per CVE across the client's endpoints. Each row shows
   whether attacks have been seen (**Known exploited** or **No known exploit**),
   the **Severity**, the **CVE**, its **Score**, how many **Endpoints** have it,
   the **Software** it matched through, and **First seen** and **Last seen**.
2. Narrow the list by **State** (**Open**, **Resolved**, **Accepted risk**, or
   **Any state**), **Exploited**, **Severity**, **CVSS score** at least 4.0,
   7.0, or 9.0, **CVE**, or **Endpoint id**.
3. Select a CVE to open it. The page lists every endpoint it was found on, with
   the **Software**, the **Installed** version, the version it is **Fixed in**
   (or **No distro fix available** for a distribution finding without a fix,
   otherwise **No fix published yet**), the **Match**, the dates, and the **State**.

A known-exploited CVE of medium severity is usually more urgent than a
critical one that nobody has exploited. A CVSS score of 0 can mean NVD has not
scored the CVE yet; a distribution severity rating can still be present.

**Match** says how sure the finding is:

| Match | Meaning |
| --- | --- |
| **Distribution verified** | The distribution security feed confirms the finding for this package and release. |
| **Upstream match** | An NVD match on a distribution package without distribution verification. |
| **Confirmed mapping** | A mapping states what this software is in the NVD. |
| **Name match, unconfirmed** | Outpost matched the installed software's name and version. Check it before acting on it. |

Each finding shows its advisory source: **Debian security tracker**, **OSV**
with the distribution, such as **OSV (Ubuntu)**, or **NVD**. Older findings
without source evidence show **Source not reported**.

Two labels separate awareness findings from the critical and high totals:

| Label | Meaning | Counted as |
| --- | --- | --- |
| **Upstream match, not distro-verified** | NVD matches a distribution package, but the distribution feed has not confirmed it. A backported fix may apply. | Unverified, excluded from critical and high totals. |
| **No distro fix available** | The distribution tracks this CVE for this release but has not shipped a fix. The finding stays listed for awareness. | No distro fix, counted separately and excluded from critical and high totals. |

To fix a finding, upgrade or remove the software. See
[Deploy software](/automation/deploy-software/) and
[Patching](/automation/patching/). The finding resolves on the next match after
the endpoint reports the change.

Each endpoint's own findings are on its **Vulnerabilities** tab.

## Accept a risk on one endpoint

Suppressing records that you accept a finding on one endpoint. It applies per
endpoint, because the same flaw on a test endpoint and on a domain controller
are different decisions.

1. Open the CVE from **Software** > **Vulnerabilities**.
2. On the endpoint's row, select **Suppress**. Only open findings can be
   suppressed.
3. In **Reason**, say why the risk is accepted. The reason is required, up to
   2,000 characters, and is what someone reviewing the decision later works
   from.
4. Select **Suppress**.

The finding moves to **Accepted risk** and stays on file with your reason and
who accepted it.

## Verify

Open the CVE again. The endpoint's row shows the state **suppressed**, the
reason, and **Accepted by** followed by who accepted it. After an upgrade, the row shows
**resolved** once the endpoint has reported its new inventory.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| The page shows **The vulnerability feed is not switched on** | The feed is not enabled for your Outpost. | Contact support. |
| An endpoint never has findings | `vuln.scan_enabled` is off for it, or it reports no software inventory. | Check **Profiles** > **Effective config** for the endpoint. |
| **Suppress** is missing on a row | The finding is not open. | Only open findings can be suppressed. |
| Suppressing is refused | You lack `alert:manage`. | Ask someone who holds it. |
| A finding stays open after an upgrade | The endpoint has not reported its inventory since. | Wait for the next inventory, or check the installed version on the endpoint. |

## Next steps

- [Patching](/automation/patching/)
- [Deploy software](/automation/deploy-software/)