VEX Generator

Step 1: Vulnerability Information

CVE ID

Looking it up prefills the fields below, including the affected component. You can still edit anything afterward.

Title

Description

CVSS Score Severity is derived automatically from the score.

Severity

Published Date

CVSS Vector

Affected Component

The specific vulnerable dependency (usually a library), as identified by the CVE. Prefilled from NVD's data when available — enter it manually if not.

Component Name

Component Version

Component Type

Step 2: Product Information

Your organization name You're the publisher of this VEX document — this becomes the document's publisher/organization identity.

Organization URL (optional)

Step 3: Assessment

Answer these questions about how this vulnerability applies to your product(s). Only answer as many as you need — status and justification are derived automatically, and later questions only appear when the answer isn't already conclusive.

1. Does the product contain the vulnerable component?

Yes No Unknown

Rationale (optional)

Recommendation (optional) Disabled when the status is Not Affected — there's nothing to recommend remediating.

Step 1: Vulnerability Information

Step 2: Product Information

Step 3: Assessment

Product

Step 4: Review

Step 5: Generate & Download

CycloneDX VEX JSON

Human-Readable Report