--- other: private: false title: See vulnerabilities --- import { Image } from "@/components/image"; # See vulnerabilities ## See a vulnerability summary The **Vulnerabilities** section is the first one you see when accessing a group. It presents you first with a summary of what has been detected in the group in terms of the quantity of vulnerabilities and the risk exposure they represent. The latter refers to the extent to which the system is vulnerable to successful cyberattacks as measured by Fluid Attacks' [CVSSF metric](https://help.fluidattacks.com/portal/en/kb/articles/cvssf-metric). ![Vulnerabilities summary](https://res.cloudinary.com/fluid-attacks/image/upload/v1761054583/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/see-vulnerability-summary-fluid-attacks-kb.webp) The summary gives you this information: - **Weaknesses:** The number of categories into which detected security issues most likely fall - **Open:** The number of weaknesses corresponding to vulnerabilities that are present in the system - **Closed:** The number of weaknesses that were reported in the past but are currently not present in the system - **Vulnerabilities:** The number of spots in the system where security issues have been detected - **Open:** The number of vulnerabilities that are present - **Closed:** The number of vulnerabilities that were reported in the past but are currently not present - **Fix Available:** The number of present vulnerabilities that can be fixed with the help of [Custom Fix](https://help.fluidattacks.com/portal/en/kb/articles/get-ai-generated-guides-for-remediation) or [Autofix](https://help.fluidattacks.com/portal/en/kb/articles/fix-code-automatically-with-gen-ai) or for which a [suggested package update](https://help.fluidattacks.com/portal/en/kb/articles/see-safe-dependency-versions) is available - **Risk exposure:** The sum of the CVSSF scores of all the vulnerabilities that have not been remediated (beneath is the percentage corresponding to the group's share of risk exposure within the organization) > \[!TIP] > > A warning icon appears next to the risk exposure value > if there are unsolved events in the group > (i.e., situations that impede testing). > To its side, there is an external link icon that directs to the group's > [Events section](https://help.fluidattacks.com/portal/en/kb/articles/resolve-events-impeding-tests). ## See the list of vulnerabilities detected > \[!CAUTION] > > - Since April 4, severity information on the platform is exclusively available in CVSS v4.0. > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Vulnerabilities** section first provides you with an overview of all the vulnerabilities detected in your software grouped by the weakness they are categorized in. ![Vulnerabilities list](https://res.cloudinary.com/fluid-attacks/image/upload/v1761056073/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/view-reported-vulnerabilities-fluid-attacks-kb.webp) > \[!NOTE] > > A weakness is a category following > [Fluid Attacks' classification](https://db.fluidattacks.com/wek/), > whereas a vulnerability is a specific instance of that weakness found in your software. ### Know the Vulnerabilities table > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Vulnerabilities** table conveniently groups the vulnerabilities detected in your system by weaknesses and provides general details. ![Vulnerabilities table](https://res.cloudinary.com/fluid-attacks/image/upload/v1761057652/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/understand-vulnerabilities-table-fluid-attacks-kb.webp) The following are short descriptions of what you find for each column: - **Weakness:** The [standardized security weakness](https://db.fluidattacks.com/wek/) best matching the characteristics of the vulnerabilities in your system - **Status:** Indicates the condition of this weakness, where it is **Open** if the weakness is present or Closed if the weakness has been remediated - **Priority:** The percentile, relative to all vulnerabilities identified so far, occupied by the vulnerability with the highest remediation priority score among all those grouped within a given weakness. The priority score calculation depends on (a) your organization's [prioritization policies](https://help.fluidattacks.com/portal/en/kb/articles/manage-fix-prioritization-policies) based on the transitivity of the affected dependency, the phase of use of the vulnerable component, whether it is listed in CISA's KEV list, the EPSS, and the estimated time to fix; and (b) a default score calculated using the Common Vulnerability Scoring System ([CVSS](https://help.fluidattacks.com/portal/en/kb/articles/glossary#CVSS)) as follows: (4^(CVSS-4)) / 4,096. - **Open vulnerabilities:** The count of vulnerabilities in your system, related to the weakness, that are still present - **Severity overview:** The number of detected vulnerabilities of each CVSS qualitative severity rating, which groups scores as follows: - **Low:** (0.1 - 3.9) - **Medium:** (4.0 - 6.9) - **High:** (7.0 - 8.9) - **Critical:** (9.0 - 10.0) - **Last reported:** Days since the last detection of a vulnerability from the respective weakness category (regardless of the current Status) - **Age:** Days since this weakness was first detected in your system - **Release date:** Date when the weakness was first reported in your system - **Remediation:** Percentage of the related reported vulnerabilities remediated by your team - **Reattack:** Status of [reattacks](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks) for this weakness ('Pending' if a reattack is due, '-' otherwise) - **Treatment:** The number of vulnerabilities per [assigned treatment](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments) > \[!TIP] > > Customize your view by reordering, > showing or hiding columns using the > [columns](#hide-and-show-columns-in-the-vulnerabilities-table) > button. You can expand rows using the downward arrow to view some of the information about the weaknesses stacked, along with some additional bits, like if the weakness is exploitable. ![Vulnerabilities table expanded row](https://res.cloudinary.com/fluid-attacks/image/upload/v1761064319/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/expand-weakness-fluid-attacks-kb.webp) > \[!NOTE] > > You might see the same weakness listed multiple times. > This is due to the grouping together of vulnerabilities that, > while pertaining to the same weakness, > differ in some aspects in specific attributes > (description, recommendations, severity, etc.). ### Spot newly reported vulnerabilities Newly reported weaknesses are highlighted with a **New** label for seven days [in the table](#know-the-vulnerabilities-table), helping you quickly identify them. ![Newly reported vulnerabilities](https://res.cloudinary.com/fluid-attacks/image/upload/v1761065022/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/identify-new-vulnerabilities-fluid-attacks-kb.webp) ### Search the Vulnerabilities table > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The search bar in the **Vulnerabilities** section lets you quickly find specific information within the table by showing only the rows whose content match your search. It is advisable you search by entering the name of the weakness, repository nickname or vulnerability location (e.g., file name). ![Search the Vulnerabilities table](https://res.cloudinary.com/fluid-attacks/image/upload/v1761067072/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/search-vulnerabilities-table-fluid-attacks-kb.webp) ### Filter the Vulnerabilities table > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager You can filter the table to facilitate your search. To access the multiple options, click the filters button (

To clear a filter, click on the **X** next to it. Remove a filter

> \[!NOTE] > > Your filters persist only in the Vulnerabilities section of the group you applied them to. You can also use a selection of quick filters: **Origin**, **Status**, and **Severity**. Remove a filter

### See top 20 vulnerabilities to prioritize > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager To identify the vulnerabilities you need to fix most urgently, click on **Show top 20 in priority rank**. ![Show top 20 in priority rank](https://res.cloudinary.com/fluid-attacks/image/upload/v1761060522/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/filter-vulnerabilities-to-prioritize-fluid-attacks-kb.png) The platform then shows you the 20 vulnerabilities with the highest Priority value within the group. The information shown in the columns is explained [further below](#see-where-vulnerabilities-are-located). You can click on **Go to vulnerability** to [see details](#see-the-details-of-a-specific-vulnerability) of the vulnerability, [apply a treatment](#edit-treatment-for-a-vulnerability), [get AI-generated remediation guidance](#get-a-custom-guide-to-fix-the-vulnerability), and more. ![Top 20 vulnerabilities to prioritize](https://res.cloudinary.com/fluid-attacks/image/upload/v1761061957/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/see-top-20-vulnerabilities-fluid-attacks-kb.png) To stop seeing the top 20, click on **Hide top 20 in priority rank**. ### Hide and show columns in the Vulnerabilities table > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager You can customize the [table](#know-the-vulnerabilities-table) view by choosing which columns to display. Click the columns button (

) to open a pop-up window where you can hide or show columns. To quickly find a desired column, you can type its name in this window's search bar. Once you are done customizing, click on **Save**. Customize vulnerabilities table on the Fluid Attacks platform

Customize vulnerabilities table on the Fluid Attacks platform

> \[!TIP] > > Use the **Reset to default** button to enable only these recommended columns: > **Weakness**, **Status**, **Priority**, > **Open vulnerabilities**, **Severity overview**, and **Last reported**. > \[!NOTE] > > Your preferences for which columns to see persist across Vulnerabilities sections within your groups. ### Reorder columns in the Vulnerabilities table > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager You can further customize the [table](#know-the-vulnerabilities-table) view by choosing the column order. Click the columns button (

) to open a pop-up window where you can drag the column names to rearrange the table. You can click on the X of a corresponding column to hide it. When you are finished, click on **Save**. Customize vulnerabilities table on the Fluid Attacks platform

> \[!NOTE] > > Your column order preferences persist across Vulnerabilities sections within your groups. ## Generate reports > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: Vulnerability Manager or Group Manager The **Generate report** option in the **Vulnerabilities** section allows you to download reports varying in detail. [Group Managers](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Group_Manager_role) additionally have the option to generate security testing certificates. For details on available report types and how to generate them, read [Download a report of detected vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/download-a-report-of-detected-vulnerabilities). ![Generate reports on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761074326/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/generate-vulnerabilities-report-fluid-attacks-kb.webp) > \[!TIP] > > Remember the feature to > [access recent downloads](https://help.fluidattacks.com/portal/en/kb/articles/access-recent-downloads)! ## See where vulnerabilities are located > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager In the **Vulnerabilities** section, when you click on the associated weakness, you then access a set of spaces dedicated to it. The header is visible across the latter, and it informs the group name, the weakness that groups the vulnerabilities, and the amount of time it may take you to remediate one vulnerability. ![Understand the vulnerability header on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761075194/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/see-vulnerabilities-remediation-time-fluid-attacks-kb.webp) The **Vulnerabilities** section informs where in your system each vulnerability related to the selected weakness was detected and provides relevant information for its management. ![View vulnerabilities locations on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1762525091/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/view-location-fluid-attacks-kb.webp) These are the descriptions of what you find in the table: - **Vulnerability**: The found vulnerability, identified by its file path > \[!NOTE] > > The copy icon in this column allows you to copy the > [URL of the vulnerability on the platform](#get-the-link-to-share-the-details-of-a-vulnerability). > \[!TIP] > > Newly reported vulnerabilities are marked with the > **[New label](#spot-newly-reported-vulnerabilities)** > for seven days. - **Specific**: The exact lines of code, inputs (e.g., password fields) or ports where the vulnerability was found (thus the repetition of files in Location sometimes). - **Origin**: Whether the vulnerability is **Inherited** (present in third-party code) or **Injected** (present in code owned by your team). - **Status**: Indicates whether the vulnerability is **Open** (present) or **Closed** (no longer present) in the line of code, input or port - **Severity** (v4.0): The [Common Vulnerability Scoring System](https://help.fluidattacks.com/portal/en/kb/articles/glossary#CVSS) (CVSS) v4.0 score assigned to the vulnerability - **Priority**: The percentile, relative to all vulnerabilities identified so far, occupied by the vulnerability. The priority score calculation depends on (a) your organization's [prioritization policies](https://help.fluidattacks.com/portal/en/kb/articles/manage-fix-prioritization-policies) based on the transitivity of the affected dependency, the phase of use of the vulnerable component, whether it is listed in CISA's KEV list, the EPSS, and the estimated time to fix; and (b) the result of `(4^(CVSS-4)) / 4,096`. - **Technique**: The security testing technique used to detect the vulnerability, which can be one of these: - **SAST**: Automated static code analysis - **DAST**: Automated dynamic analysis - **SCA**: Automated analysis of third-party dependencies - **CSPM**: Automated analysis of cloud environments - **SCR**: Static code analysis done manually - **PTaaS**: Dynamic analysis done manually - **RE**: Reverse engineering of your system done manually - **Treatment**: The defined [treatment](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments) for the vulnerability: - **Untreated**: The vulnerability treatment assignment is due - **In progress**: The remediation of the vulnerability has been assigned to a member of your team - **Temporarily accepted**: The vulnerability is accepted until a defined date - **Permanently accepted**: The vulnerability is accepted indefinitely - **Treated**: The vulnerability is no longer present - **Report date**: The date and time when the vulnerability was reported - **Treatment acceptance**: The status of a vulnerability acceptance request, which may be one of the following: - **Submitted**: The initial status of the request while waiting for the decision of a Vulnerability Manager or Group Manager - **Approved**: The request was approved by a member with any of the above roles - **Rejected**: The request was denied by a member with any of the above roles - **Reattack**: Status of [reattack requests or outcomes](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks), if applicable, which may be one of the following: - **Pending**: Fluid Attacks is yet to communicate the outcome of the requested reattack - **On hold**: The requested reattack is not possible until your team solves an [event impeding testing](https://help.fluidattacks.com/portal/en/kb/articles/resolve-events-impeding-tests) - **Verified open**: The reattack evidences the vulnerability is still present - **Verified closed**: The reattack evidences the vulnerability is no longer present - **Tags**: Any tags you or your team have added to identify the vulnerability > \[!TIP] > > Type a tag in the search bar to see only vulnerabilities labeled with it. > And go to [Analytics](https://help.fluidattacks.com/portal/en/kb/articles/common-analytics#Vulnerabilities_by_tag) > to see the number of vulnerabilities > for each of the tags you or other team members have created. - **[Zero risk](https://help.fluidattacks.com/portal/en/kb/articles/request-a-vulnerability-be-dismissed-as-zero-risk)**: Whether your organization has flagged the vulnerability as representing no risk to it - **Assignees**: The individuals assigned to address the vulnerability To access the options to show, hide, or reorder columns, click the columns (

) button. This causes a pop-up window to appear. On the left, you can make your selection, and on the right, reorder the enabled columns. Click **Save** to apply the changes. Customize vulnerabilities table on the Fluid Attacks platform

> \[!TIP] > > Use the **Reset to default** button to enable only these recommended columns: > **Vulnerability**, **Specific**, **Status**, **Severity (v3.1/4.0)**, > **Priority**, **Technique**, **Treatment**, and **Report date**. > \[!NOTE] > > Your preferences for which columns to see persist across Vulnerabilities sections within your groups. A way to quickly find what you are looking for in the table is typing search terms in the search bar. Immediately, only the rows whose content matches your search are shown. ![Search vulnerability location on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761077301/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/search-locations-table-fluid-attacks-kb.webp) You can limit the information you see on the table by clicking on the filters button (

) and using one or more of the available options. Find filters in Vulnerabilities on the Fluid Attacks platform

Filter by Technique on the Fluid Attacks platform

Apply filters in Locations on the Fluid Attacks platform

You can also use a selection of quick filters: **Location**, **Status**, and **Origin**. Use quick filters on the Fluid Attacks platform

> \[!TIP] > > The **Location** filter and quick filter make the table display > only the vulnerabilities detected in the target of evaluation > (e.g., Git repo, environment URL) whose name you type. ## See inside a vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager You can click on a vulnerability in the Vulnerabilities section to open a pop-up window with a header and multiple tabs: [Details](#see-the-details-of-a-specific-vulnerability), [Severity](#learn-the-severity-of-a-specific-vulnerability), [Code](#see-the-vulnerable-line-of-code) (if applicable), [Treatments](#edit-treatment-for-a-vulnerability) (if applicable), [How to fix](#get-a-custom-guide-to-fix-the-vulnerability), and [Tracking](#see-the-history-of-a-specific-vulnerability). This window has a unique URL for easy sharing with team members or Fluid Attacks staff, which you can [copy](#get-the-link-to-share-the-details-of-a-vulnerability) by clicking on the link icon. The header is visible across the tabs and consists of tags that inform you of the vulnerability's [Severity, Origin, Technique and Status](#see-where-vulnerabilities-are-located) information. If the vulnerability is in third-party software, a tag related to reachability is shown. This tag may have one of these values: - **Latent**: (a) The vulnerability is in a package declared in your code, but (b) the package is not imported. - **Potential**: (a) The vulnerability is in a package declared in your code, (b) the package is imported by your application's code, but (c) the vulnerability is not necessarily the vulnerable function described in the CVE entry. - **Reachable**: (a) The vulnerability is in a package declared in your code, (b) the related package is imported by your application's code, and (c) the vulnerability is the vulnerable function described in the CVE entry. ### See the details of a specific vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Details** tab provides comprehensive information about the state of the selected vulnerability. View vulnerability details on the Fluid Attacks platform

View vulnerability details on the Fluid Attacks platform

These are the details shown in this tab: - **General information**: - **Location**: The file path or environment URL - **Specific LoC/port/input**: The specific line of code, port number, or input field affected - **Report date**: The date the vulnerability was reported - **Closing date**: The date it was verified the vulnerability is no longer present or, for another reason, its Status changed from 'Open' to 'Closed' - **Closing reasons**: The reason the vulnerability's Status changed from 'Open' to 'Closed' - **Commit hash**: ID of the commit that created the vulnerability - **Zero risk**: Indicates if the [Zero risk treatment](https://help.fluidattacks.com/portal/en/kb/articles/request-a-vulnerability-be-dismissed-as-zero-risk) has been applied to this finding (your organization requests this treatment if the finding poses no risk) - **Tags**: User-defined tags for identifying the vulnerability - **Time to detect (days)**: The days it took to report the vulnerability since the commit that introduced it - **Code author**: Email of the contributor whose commit presents the vulnerability in question - **Vulnerability description**: [Fluid Attacks' definition](https://db.fluidattacks.com/wek/) of the vulnerability - **Reattacks**: - **Reattack status**: If applicable, the outcome of the last [reattack](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks) request (for possible values, see [above](#see-where-vulnerabilities-are-located)) - **Last requested date**: The date of the most recent reattack request - **Requester**: The email of the member who requested the last reattack - **Cycles**: The total number of reattack requests for this vulnerability - **Efficiency**: The percentage representing one positive reattack outcome (confirming the vulnerability was fixed) out of all the reattacks carried out - **Treatments**: - **Current treatment**: The currently applied treatment for the vulnerability - **Assignee**: The email of the member assigned to address the vulnerability - **Treatment date**: The date the treatment was applied - **Treatment expiration date**: The expiration date for a Temporarily accepted treatment - **Changes**: The number of times the treatment of that vulnerability has changed - **Bug tracking system url**: URL of the issue in your bug tracking system (BTS) related to this vulnerability - **Justification**: The reason provided for applying the treatment - **Packages details**: (Visible only for vulnerabilities found via [SCA](https://help.fluidattacks.com/portal/en/kb/articles/what-is-sca)) - **Dependency**: The name of the vulnerable package - **Transitivity**: Whether the vulnerable file in your software is directly or indirectly related to the third-party component in question: - **Direct**: The file in your project explicitly imports and uses the third-party dependency - **Transitive**: The third-party dependency is required by your direct dependencies, but not directly imported by the file in your project - **Undeterminable**: For this file, it is impossible by anyone to determine whether the dependency is direct or transitive - **Advisory ID**: The associated Common Vulnerabilities and Exposures ([CVE](https://cve.mitre.org/)) identifier of the vulnerable version - **%EPSS**: The likelihood of the vulnerability being exploited compared to that of all other known vulnerabilities - **Stage**: The stage(s) in which your project depends on the third-party dependency: - **Build**: Your file depends on the third-party component only in the software development stage - **Run**: Your file depends on the third-party component in the live production environment - **Reachability**: Whether the function related to the vulnerability is called by your application's code (see a description of the possible values [above](#see-inside-a-vulnerability)) - **Version status**: Whether you are using the dependency in its latest version or a newer one is available (it also indicates the specific used version and the latest one) - **Affected version**: The vulnerable dependency version - **CPEs**: The string following the [Common Platform Enumeration](https://nvd.nist.gov/products/cpe) (CPE) for identifying the dependency - **Namespace**: Identifier indicating the supplier organization or project for the entry - **Advisory URLs (\[#])**: Reference URLs (e.g., URL of the vulnerability advisory) - **KEV**: Whether the related vulnerability is in CISA's Known Exploited Vulnerabilities Catalog, meaning it has been exploited in the wild ### Learn the severity of a specific vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Severity** tab provides detailed information about the CVSS severity score assigned to the specific vulnerability. Know vulnerability severity on the Fluid Attacks platform

Know vulnerability severity on the Fluid Attacks platform

These are the details shown: - **Vector CVSS v4.0 string**: The values used to derive the score represented textually > \[!TIP] > > Click the string to follow the link to the [score calculator](https://www.first.org/cvss/calculator/4.0) > showing said values. - The calculated severity score and its corresponding qualitative rating - The severity score breakdown showing the values for each metric along with a visual representation of the value > \[!TIP] > > Hover over the metric to reveal its definition > and the description of its possible values. ### See the vulnerable line of code > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Code** tab highlights the vulnerable code snippet and shows the code surrounding it, allowing you to pinpoint the issue directly within your codebase. View the vulnerable line of code on the Fluid Attacks platform

View the vulnerable line of code on the Fluid Attacks platform

### Edit treatment for a vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Treatments** tab allows you to manage the treatment for the vulnerability, as well as manage tags and link to the related issue in a bug tracking system. Read about these fields in [Assign treatments](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Define_a_treatment_for_a_vulnerability). View vulnerability treatments on the Fluid Attacks platform

View vulnerability treatments on the Fluid Attacks platform

### Get a custom guide to fix the vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager > \[!CAUTION] > > Always review the accuracy of remediation guides generated with AI. > \[!NOTE] > > AI-generated fix guides are only available for vulnerabilities > detected via SAST or SCR in [supported languages](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages-for-vulnerability-fixes). From the pop-up window, you can immediately get a step-by-step, custom, AI-generated guide to remediate the vulnerability. Simply select the **How to fix** tab or click the fix button (

) on the Fluid Attacks platform and let Fluid Attacks' [Custom fix feature](https://help.fluidattacks.com/portal/en/kb/articles/get-ai-generated-guides-for-remediation) create this useful resource for you to plan the remediation of the vulnerability in question. Bear in mind that this feature is not available for some vulnerabilities.

Find fix button on the Fluid Attacks platform

Fix with AI on the Fluid Attacks platform

### Get an automatic fix for the vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager > \[!CAUTION] > > Always review the accuracy of remediation guides generated with AI. > \[!NOTE] > > AI-generated fix guides are only available for vulnerabilities > detected via SAST or SCR in [supported languages](https://help.fluidattacks.com/portal/en/kb/articles/supported-languages-for-vulnerability-fixes). Automatic fix suggestions are currently only available on VS Code and Cursor using the [Fluid Attacks extension](#get-a-custom-guide-to-fix-the-vulnerability). If Fluid Attacks has an automatic fix for the vulnerability, a button labeled **Auto-fix** appears after you click the **How to fix** tab or click the fix button (

). Clicking on the button enables a pop-up window that displays requirements for using the feature and a link to download the extension. ![Get autofix information on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1753209234/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/fix-automatically-fluid-attacks-kb.png) ### See the recommended dependency version > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager In the case of inherited vulnerabilities, the How to fix tab shows you what dependency versions you should upgrade to. To learn more, read [See safe dependency versions](https://help.fluidattacks.com/portal/en/kb/articles/see-safe-dependency-versions). ### See the history of a specific vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Tracking** tab allows you to see the management decisions made over a vulnerability over time, including changes in status, treatments, and other relevant details. See timeline of a vulnerability on the Fluid Attacks platform

See timeline of a vulnerability on the Fluid Attacks platform

### Get the link to share the details of a vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager You can easily share the pop-up window for a vulnerability with others, as it has got a unique URL containing the vulnerability ID. To copy the URL, simply click on the copy icon ( Copy button

Get a vulnerability link on the Fluid Attacks platform

> \[!TIP] > > This feature is also available > through the copy icon in the **Vulnerability** column. ## See the description of vulnerabilities > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Description** section provides definitions and relevant characteristics to more clearly understand the issues and possible fixes. ![View vulnerability description on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761078584/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/view-vulnerability-description-fluid-attacks-kb.webp) Specifically, this section provides the following information: - **Description**: Fluid Attacks' definition of the weakness in question - **Related requirements**: The security requirements, according to Fluid Attacks' classification, that may have been violated - **Impacts**: What an attacker can achieve exploiting the vulnerability - **Threat**: The attack vector an attacker has to follow and the privileges they require to exploit the vulnerability - **Recommendations**: Advice for remediating the vulnerability - **Do you need help with this vulnerability?**: Link to schedule a [video meeting to discuss the vulnerability](https://help.fluidattacks.com/portal/en/kb/articles/talk-to-a-hacker) with one of Fluid Attacks' pentesters ## See evidence of exploitability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager In the **Evidence** section you may find screenshots of code snippets demonstrating the presence of vulnerabilities and screenshots or videos showing the ethical exploitation of some of those vulnerabilities. You can click on these resources to enlarge them and then download them. Learn more details about this section in [Examine the evidence of exploitability](https://help.fluidattacks.com/portal/en/kb/articles/examine-the-evidence-of-exploitability). See vulnerability evidence on the Fluid Attacks platform

See vulnerability evidence on the Fluid Attacks platform

## See the timeline of vulnerabilities > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager In the **Tracking** section, you can view vulnerabilities' timeline, detailing cycles which are marked by reattack outcomes and any temporary and permanent acceptance treatments. To see the timeline for a vulnerable line of code, input or port, refer to [See the history of a specific vulnerability](#see-the-history-of-a-specific-vulnerability). ![See the history of a type of vulnerability on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761079003/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/view-history-vulnerability-type-fluid-attacks-kb.webp) ## See affected records > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Records** section contains sensitive information gathered by Fluid Attacks' pentesters during ethical vulnerability exploitation. This information is specific to your organization and may include financial details (e.g., account numbers, transactions, credit card numbers), personal data (e.g., phone numbers, contacts, personally identifiable information) and technical information (e.g., roles, keys, access tokens). ![See affected records on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1762525715/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/view-records-fluid-attacks-kb.webp) > \[!NOTE] > > The information in this section is stored only here > and is exclusively accessible to authenticated users > with proper permissions within your group. ## Comment on vulnerabilities > \[!NOTE] > > **[Plan](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing#Continuous_Hacking_plans) > required**: Advanced > \[!NOTE] > > The Comments section is available in the Essential plan in view-only mode. > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager The **Comments** section is a forum-like space for discussions between your team and Fluid Attacks about the vulnerabilities in question. Any member can post a new thread or reply to an existing one. To learn more about this help option, read [Post comments](https://help.fluidattacks.com/portal/en/kb/articles/post-comments). ![Comment on a type of vulnerability on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761079772/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/comment-on-vulnerability-type-fluid-attacks-kb.webp) > \[!TIP] > > Excited to learn more about the platform? > Explore [Meet the platform](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities/use-the-platform/meet-the-platform) > to learn where to start and where everything is. ## Notify of a vulnerability > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: Vulnerability Manager or Group Manager The Fluid Attacks platform allows you to send an email notification to members informing them of the vulnerabilities still present. To do this, follow these steps: 1. Access the group where the target vulnerability was detected. 1. In the **Vulnerabilities** section, click on the associated weakness. ![Select a type of vulnerability on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761080363/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/select-weakness-fluid-attacks-kb.webp) 1. In the **Vulnerabilities** section, click on the notify button (

). ![Notify team members of vulnerabilities on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1744120768/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/notify-team-of-vulnerabilities-fluid-attacks-kb.webp) 1. In the pop-up window, confirm the delivery by clicking **Notify**. Confirm vulnerability notification on the Fluid Attacks platform

Confirm vulnerability notification on the Fluid Attacks platform

The notification is then sent to members who have [Vulnerability alert](https://help.fluidattacks.com/portal/en/kb/articles/enable-and-disable-notifications#Vulnerability_alert) enabled. ## Request reattacks > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: User, Vulnerability Manager or Group Manager From Fluid Attacks' platform, you can send requests to verify the effectiveness of your code fixes. These retests done by Fluid Attacks are called reattacks. To request them, you have to check the boxes of the vulnerabilities in the [**Vulnerabilities** section](#see-where-vulnerabilities-are-located), and click on **Reattack**. Find the entire details about this feature in [Verify fixes with reattacks](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks). ![Find the retest option on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761098940/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/select-vulnerability-to-reattack-fluid-attacks-kb.webp) ## Edit treatment, assignee, BTS link and more > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: Vulnerability Manager or Group Manager > \[!NOTE] > > Members with the User role can assign fix work > to themselves and edit the External BTS, Tags and Priority values. You can modify vulnerability management decisions from the platform's **Vulnerabilities** section. To make your modifications, follow these steps: 1. Go to **Vulnerabilities** by clicking on a weakness name. 1. In the table, select the checkbox on the left of the vulnerability that you need to edit. 1. Click the **Edit treatment** button. ![Edit locations on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761099344/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/edit-vulnerability-fluid-attacks-kb.webp) 1. Make the necessary changes in the form. **Treatment** and **Assignee** can only be modified by [Vulnerability Managers](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Vulnerability_Manager_role) and [Group Managers](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Group_Manager_role). (For the descriptions of the fields, read [Assign treatments](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Define_a_Treatment_for_a_vulnerability).) ![Add new vulnerability tag on the Fluid Attacks platform](https://res.cloudinary.com/fluid-attacks/image/upload/v1761099759/docs/find-and-fix-vulnerabilities/use-the-platform/manage-vulnerabilities/tag-vulnerability-fluid-attacks-kb.webp) 1. Click on **Confirm** to apply the changes. ## Approve vulnerability acceptance requests > \[!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) > required**: Vulnerability Manager or Group Manager In the **Vulnerabilities** section, you can approve the request for a vulnerability to be temporarily or permanently accepted. You do this with the **Treatment acceptance** option. To learn all the details, read about this topic in [Assign treatments](https://help.fluidattacks.com/portal/en/kb/articles/assign-treatments#Approve_or_reject_vulnerability_acceptance_treatments). Accept vulnerability treatment on the Fluid Attacks platform

Accept vulnerability treatment on the Fluid Attacks platform

> \[!TIP] > > **Free Trial:** > Search for vulnerabilities in your apps for free > with Fluid Attacks' automated security testing! > Start your [21-day free trial](https://app.fluidattacks.com/SignUp) > and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) > [Essential plan](https://fluidattacks.com/plans/). > If you prefer the Advanced plan, > which includes the expertise of Fluid Attacks' hacking team, > fill out [this contact form](https://fluidattacks.com/contact-us/).