Check any finding against public sources that the tool vendor does not control. OSV tells you which versions are affected, CISA's Known Exploited Vulnerabilities catalog tells you whether exploitation has been seen, and CWE names the weakness class. Agreement across sources is a good sign.
OSV for affected versions
OSV is a service that helps developers find known vulnerabilities in open source dependencies. According to its documentation, it aggregates vulnerability databases that adopt the OpenSSF vulnerability format, and you can query by version number or commit hash, using endpoints such as POST /v1/query. OSV-Scanner is its first-party tool.
Use it to confirm that the exact version of a package in your lockfile is listed as affected. If a tool flags a package and OSV shows no record for your version, ask the tool why. There may be a reason, such as another source, but you should know it.
CISA KEV for exploitation
CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities exploited in the wild. When we checked, the page showed 1,748 entries and described itself as an input to a vulnerability management prioritization framework, not the whole framework. Each entry includes a CVE ID, vendor and product, a description, a due date and required actions.
Use it to separate "has been exploited" from "could be exploited." A tool that marks a finding as actively exploited should be able to match it to such a source.
CWE for the weakness class
The Common Weakness Enumeration is a community-developed list of software and hardware weaknesses, sponsored by CISA and operated by MITRE. Use it to check that a tool's description of a flaw matches a recognized class, and to compare coverage between tools in a common vocabulary.
A five minute routine
- Take five findings from each tool, mixed severities.
- Look up the package and version in OSV.
- Check each CVE against KEV.
- Compare the tool's weakness label with the CWE entry.
- Note disagreements and ask each tool why.
If one tool fails more checks than another on the same sample, that is a data point you can defend.
Limits
Public sources lag, and absence from KEV does not mean safe. Use these as cross checks, not as a replacement for judging impact in your own code. Our post on fair scanner tests explains how to label findings.
Try it yourself
Click through it at your own pace, or open it full screen.
Note what evidence the demo uses to judge exploitability, and compare it with the public sources above.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and zero-day discovery. Try the free scan at gold.safeguard.sh/scan and verify the output yourself.
Quick check
If a CVE is not in KEV, can I ignore it?
No. KEV lists known exploitation, not all risk. Use it to raise priority, not to dismiss findings.
Sources
Last reviewed: 19 October 2026.
