Read the vulnerabilities of a release

For each supported release, the Vulnerabilities tab of the product lists the known vulnerabilities of its components, in the order that matters for the CRA.

The order

1. Exploited: listed in CISA’s Known Exploited Vulnerabilities catalogue or the EU Vulnerability Database (EUVD). These are the ones that can start the reporting clock: open a reporting case from the vulnerability if it affects the product.
2. To assess: the others, with their severity and, where available, their EPSS score (Likely to be exploited when it is high), so you can fix first what is most likely to be exploited.

Each line gives the component, the version that fixes it when there is one, and your current assessment. Pick a line to open its details beside the list (J and K move from one to the next), filter by severity, reachability or text, and tick several (X) to record the same decision for all of them. A decision just saved can be undone from the message at the foot of the screen.

Components at the end of their support

On the Pro and Consultant plans, the Releases tab has a table that lists components whose own support ends before your product’s support period: a library, a runtime or an operating system you will have to replace or justify.

How often

Every supported release is checked daily on paid plans (weekly on Free), and at once when you upload it. Check now runs it again on demand. You get an alert when something new appears.