Enabling efficient upstream vulnerability assessment with VEX, SBoMs, and CVE scan results
Enabling efficient upstream vulnerability assessment with VEX, SBoMs, and CVE scan results
11 PagesThis technical white paper explains how the Tanzu Application Catalog integrates Software Bills of Materials (SBoMs), CVE scan results, and Vulnerability Exploitability eXchange (VEX) documents. It demonstrates how these components work together to reduce false positives, prioritize real threats, and streamline vulnerability remediation. Through Trivy integration, VEX dynamically filters exploitable vulnerabilities, providing DevSecOps teams with more actionable intelligence for securing open-source software supply chains.
