Vulnerabilities Overview

Overview

One of the foundational analyses that Manifest performs on SBOMs is a robust and curated vulnerability scan. Identifying vulnerabilities can help your team make internal products more secure (for first-party code), or help your third-party risk management (TPRM) teams identify weaknesses in vendor products.

Vulnerability Matching

At a high level, Manifest extracts, cleans, and heals Common Product Enumeration (CPEs) and Package URLs (Purls) from SBOMs, and cross-references those identifiers in NIST's National Vulnerability Database (NVD) as well as Google's Open Source Vulnerability database (OSV), which itself is an aggregation of over a dozen different vulnerability sources.

Manifest also deduplicates vulnerabilities, hides vulnerabilities marked as deprecated or rejected, and performs other cleanup and checks to help reduce noise for end users.

Feel free to reach out to Manifest support for more information about how we do vulnerability matching.

Vulnerability Enrichment

When dealing with security vulnerabilities, it’s crucial to focus on the ones that pose the greatest risk while not wasting time on those unlikely to be exploited. Manifest enriches vulnerabilities with several best-in-breed sources of data:

CISA's Known Exploited Vulnerabilities (KEV) Catalog

Maintained by the Cybersecurity & Infrastructure Security Agency (CISA), the KEV catalog lists vulnerabilities that have been actively exploited in the wild, as confirmed by the US Government. Since these vulnerabilities are already being used in attacks, they should be treated as high-priority for remediation.

FIRST's Exploit Prediction Scoring System (EPSS)

Developed by the Forum of Incident Response and Security Teams (FIRST), the EPSS assigns a probability score to vulnerabilities based on whether they are likely to be exploited within the next 30 days, given various factors such as the vendor who made the software, the level of access required to exploit the vulnerability, whether an exploit exists in the wild, etc. This predictive model helps organizations prioritize vulnerabilities that are most likely to be exploited, reducing unnecessary patching efforts on low-risk issues.

Why These Matter

By leveraging both KEV and EPSS, security teams can focus on what matters most:

KEV ensures that already exploited vulnerabilities are patched immediately.
EPSS helps predict which unexploited vulnerabilities are most likely to become threats.

This approach allows security teams to remediate high-risk vulnerabilities efficiently while avoiding wasted effort on less critical issues.

European Union Vulnerability Database (EUVD)

The European Union Agency for Cybersecurity (ENISA) maintains the European Union Vulnerability Database (EUVD), the official vulnerability database for the European Union, established under the NIS2 Directive. The EUVD does not replace the CVE Program or NIST's National Vulnerability Database (NVD). Instead, it adds a second, EU-run source of vulnerability data.

Manifest Cyber checks the EUVD every day for a matching identifier on vulnerabilities that already have a Common Vulnerabilities and Exposures (CVE) identifier in your instance. When a match exists, the platform adds the EUVD identifier as an alias on that vulnerability, displays it next to the matching CVE, and links directly to the EUVD record. For example, a vulnerability record might show:

CVE-2011-4858 / EUVD-2022-5625

If a vulnerability has more than one EUVD alias, Manifest shows the first one with a "+N others" indicator. The EUVD also appears in the Sources section of the record alongside NVD and the Open Source Vulnerability database (OSV).

You can search by EUVD identifier directly. Enter an EUVD ID, such as EUVD-2026-2867, in the vulnerability search bar, and Manifest returns the matching vulnerability record.

A note on how matching works: EUVD enrichment depends on a CVE identifier already existing in your instance. If a vulnerability has no CVE, an EUVD alias alone does not create a new vulnerability record for it. This is by design. Manifest treats the EUVD as a reference and reporting layer on top of CVE-based vulnerability data, not as a separate stream of vulnerabilities to match and triage.

Why This Matters

Regulatory alignment. Teams working through NIS2 or Cyber Resilience Act (CRA) obligations can trace a vulnerability back to the same authority, ENISA, that governs those obligations, using the same record they already work from in Manifest.
No new workflow. EUVD data appears on the vulnerability record customers already use. There is no separate report, export, or tool to check.
Searchable either way. Whether a team looks up a vulnerability by its CVE ID or its EUVD ID, they land on the same record.