VEX

Vulnerability Exploitability eXchange

Definition

A machine-readable companion to an SBOM that states whether a known vulnerability actually affects a given product (e.g., 'not affected because component is not invoked'). Reduces noise from SBOM scans.