Work with results

Exploits in scan reports

Reading the Exploit column in scan reports: which reported CVEs have a known exploit.

The spreadsheets in a scan's report say, for each CVE they list, whether it has an exploit. The evidence comes from the Exploitable Vulnerabilities Database, which is shipped with ScanSuite and searched locally. This page is about reading it in the reports.

Which reports carry it

Scanner	Scan page	Where in the archive
Trivy, the dependency check	Static Code Analysis	trivy-dep-report.xlsx
Nessus	Infrastructure Checks	The Nessus report folder
OpenVAS	Infrastructure Checks	The OpenVAS report folder
Nuclei	Infrastructure Checks	The Nuclei report folder
Local Patching Checks	Infrastructure Checks	Its report folder

Read the Exploit column

Download the scan's report: Report on its row in Scan History, or Download report on the scan's page.
Check: a ZIP archive downloads.
Open the archive and the XLSX file of the scanner, for example trivy-dep-report.xlsx, or the scanner's folder.
Read the Exploit column: Yes when the database holds exploitation evidence for the CVE, No when it holds none.

Report archive contents — The XLSX reports inside the archive

Scanner report folder — A scanner report folder

Enriched report exploit column — The Exploit column in an enriched report

What to do with it

Fix the CVEs with an exploit first. For details of one — the evidence level, the exploit references, the affected versions — search it in Vuln DB.
For code dependencies, Dependency reachability goes further: it checks whether your code reaches the vulnerable function of each dependency CVE that has exploitation evidence.

Last reviewed 2026-10-19