Vulnerabilities

With Vulnerabilities dashboard, you can track software vulnerabilities detected in your cloud workloads, prioritize them by severity and exploitability, and manage exemptions individually or by creating exemption rules that apply across matching vulnerabilities. Plerion’s CWPP (Cloud Workload Protection Platform) scans your workloads — including EC2 instances, Lambda functions, ECS tasks, ECR container images, and AMIs — and surfaces known vulnerabilities (CVEs) in installed packages. The Vulnerabilities dashboard gives you a centralized view of these findings, with tools to filter, group, analyze exploitability, and exempt vulnerabilities that do not require action.

---

​

Severity levels

Each vulnerability is assigned a severity level based on its CVSS (Common Vulnerability Scoring System) score, as published by NIST’s National Vulnerability Database (NVD). These levels help you prioritize based on potential impact:

• Critical Immediate and significant threats, often exploitable. Require urgent attention and remediation.
• High Severe risks that could lead to major impact. Require prompt action.
• Medium Issues with moderate impact. Should be remediated within a reasonable timeframe.
• Low Minimal impact or unlikely to be exploited. Still recommended to resolve.

---

​

EPSS scores

Each vulnerability can carry an Exploit Prediction Scoring System (EPSS) score: the probability that the vulnerability will be exploited in the wild in the next 30 days. Severity tells you how bad exploitation would be. EPSS tells you how likely it is, so use the two together to decide what to fix first. EPSS scores are published daily by the Forum of Incident Response and Security Teams (FIRST). See first.org/epss for how the model works.

​

How Plerion shows the score

Plerion shows the score as a percentage with one decimal place, such as 94.3%. A score above zero but below 0.1% shows as <0.1%, and a score above 99.9% shows as >99.9%. Hover a score to read what it means, such as “94.3% chance this vulnerability is exploited in the wild in the next 30 days”. A vulnerability with no score shows No score, or no EPSS label at all. No score is never shown as 0%.

• Vulnerabilities tab: Each row with a score shows an EPSS badge, such as EPSS 94.3%.
• Vulnerability details: The EPSS score tile shows the score, the date FIRST published it, and a link to FIRST.
• Code security: A code scan issue shows its EPSS score and the date FIRST published it.

​

When a vulnerability gets its score

A vulnerability gets its score when its asset is next scanned, and the score is updated on every scan after that. Until then it shows no score. A vulnerability also has no score when FIRST hasn’t scored it, for example because its ID is not a CVE.

​

Filter and sort by EPSS

Two filters are available on the Vulnerabilities tab, the asset inventory’s vulnerabilities tab, a code repository’s Issues tab, and vulnerability widgets in custom reports:

• EPSS score: Drag the slider to keep vulnerabilities with a score inside a range, from 0% to 100%. Once you add this filter, vulnerabilities with no score are left out, even at the full range, which reads Any score (scored vulnerabilities only).
• Has EPSS score: Choose Yes to keep only scored vulnerabilities, or No to find the ones with no score. Choosing No turns off the EPSS score range.

On the Vulnerabilities tab and on a code repository’s Issues tab, choose EPSS score under Sort by to see the highest scores first. Vulnerabilities with no score come last.

​

Use EPSS in workflows and exemption rules

• Workflows: Add an EPSS score condition to a vulnerability workflow to alert or open a ticket only when the score is in a range, such as 10% or higher. It can be the only condition, or you can combine it with others, such as Severity level. See Workflows.
• Exemption rules: Add an EPSS score condition to exempt vulnerabilities whose score is in a range, such as 1% or lower, or a Has EPSS score condition to exempt vulnerabilities with or without a score. Either can be the only condition in a rule, or you can combine them with others, such as Asset group. See Creating exemption rules.

A vulnerability with no score never matches an EPSS score condition, even one set to the full 0% to 100% range.

​

Alerts, tickets and exports

• Alerts and tickets: Jira, Linear, Asana and Slack messages for a vulnerability include a line such as EPSS: 91.0% chance of exploitation in the next 30 days, when the vulnerability has a score. Email shows the same sentence under the label EPSS score:.
• CSV download: The vulnerabilities CSV has an EPSS score column and an EPSS score date column, the date FIRST published the score. Both are empty when there is no score.
• Customer API: Vulnerabilities returned by the list vulnerabilities API and a code scan’s vulnerabilities carry epssScore, a probability from 0 to 1, and epssScoreDate, the date FIRST published the score. Both are null when there is no score. The list API also filters on epssScoreGte, epssScoreLte and hasEpssScore, and sorts on epssScore. The Plerion CLI has matching options.

---

​

Overview tab

The Overview tab provides a high-level summary of your vulnerability posture across all scanned workloads.

​

Total vulnerabilities

The left panel shows the current count of vulnerabilities broken down by severity — Critical, High, Medium, and Low — along with a sparkline trend for each. The total number of scanned workloads is also displayed at the bottom.

​

New vs resolved vulnerabilities

The main chart tracks the trend of new and resolved vulnerabilities over time. You can adjust the date range (last 30 days by default) and filter by severity level using the dropdowns above the chart. The red line represents new vulnerabilities detected and the green line represents resolved vulnerabilities.

​

Top vulnerabilities

Below the chart, the Top vulnerabilities section lists the most significant vulnerabilities across your environment. Each entry shows:

• The CVE ID and description
• Severity level
• The affected asset, including provider, integration, region, and asset group
• Context badges such as Publicly exposed, Exploited vulnerability, CVSS exploitable, and Fixable

---

​

Vulnerabilities tab

The Vulnerabilities tab lists all detected vulnerabilities across your scanned workloads, with options to group, filter, and take action.

​

Grouping

You can group vulnerabilities by None, Vulnerability, Provider, Integration, Asset group, Resource type, Asset, or Severity. When grouped by Vulnerability, each row shows the CVE ID, description, severity, and the number of affected assets. Click the expand arrow to see individual affected assets.

​

Filtering

Use the filter panel on the right to narrow results by:

• Asset: Search by asset name
• Vulnerability ID: Search by CVE ID
• Package name: Filter by affected package
• Target type: Filter by package ecosystem
• Environment: Production or Non-production
• Exploited vulnerability: Whether the vulnerability is known to be exploited in the wild
• Exploit exists: Whether a public exploit exists
• CVSS exploitable: Whether the vulnerability is CVSS exploitable
• Severity: Critical, High, Medium, or Low
• Integration: Your connected cloud environments
• Asset group: Asset groups you have created
• Has vendor fix: Whether a fixed version is available from the vendor
• EPSS score: A range of EPSS scores. See Filter and sort by EPSS
• Has EPSS score: Whether the vulnerability has an EPSS score
• Asset context: e.g., publicly exposed
• Target class: e.g., os-pkgs, lang-pkgs
• Region: Cloud provider regions
• Tags: Filter by tag key and value

​

Download

Click the download icon at the top right of the vulnerabilities list to export results as a CSV file.

​

Actions per vulnerability

Each vulnerability row includes action buttons:

• Exempt: Open the exemption modal for this specific vulnerability and asset
• View: Open the vulnerability detail panel
• Analyze exploitability: Ask Pleri to assess whether this vulnerability is exploitable in your specific environment

---

​

Vulnerability details

Click View on any vulnerability to open a detailed side panel with full context:

• Severity and status The CVE ID, description, severity level (Critical, High, Medium, or Low), and whether a vendor fix is available (Fixable badge). First and last observed dates are also shown.
• Remediation guidance with Pleri Click Ask Pleri to get step-by-step remediation guidance and suggestions tailored to the vulnerability and affected asset
• Primary asset The affected resource, including the asset name, environment, asset group, region, and resource type (e.g., AWS::EC2::AMI, AWS::ECR::ContainerImage).
• Tags Metadata associated with the asset, such as date, owner, and name.
• Overview The published date, links to the NIST National Vulnerability Database entry and the CVE record.
• Affected packages Details about the vulnerable package, including:
  • Target path: The scan target (e.g., ip-172-31-6-144 (ubuntu 24.04))
  • Target class: The package class (e.g., os-pkgs)
  • Target type: The package ecosystem (e.g., ubuntu)
  • Package name: The affected package
  • Installed version: The currently installed version
  • Fixed version: The version that resolves the vulnerability
• Exploited vulnerability Indicates whether the vulnerability is known to be exploited in the wild.

---

​

Exemptions tab

The Exemptions tab displays all vulnerabilities that have been exempted, whether individually or through exemption rules. Use this tab to review, manage, and audit your exemptions.

---

​

Exempting vulnerabilities

You can exempt vulnerabilities that are acceptable risks, mitigated by compensating controls, have no vendor fix available, or are not in use.

​

Exempting an individual vulnerability

​

Creating exemption rules

For recurring exemptions, you can create exemption rules at the profile level. These rules automatically exempt any vulnerability that matches the defined conditions, so you don’t need to exempt each occurrence individually.