Affected-Product Resolution Service

v1.0.0

Resolving the 80–85% NVD enrichment backlog into machine-matchable CPE & Package URLs

Audience & Architecture Guide
•
This Dashboard (Internal): Security Reviewer Portal (The "Human Gate") where researchers audit ambiguous mappings and submit corrections that dynamically train the active learning loop.
•
Customer Scanners (External DaaS): Automated tools (Tenable, Wiz, Snyk, SBOM matchers) consume these resolved mappings via Pull API, Bulk JSON Export, or NVD CPE Matcher Format.
Human Gate Queue
5
Priority 1-Hour SLA for KEV/Critical items
Delivered Mappings
7
Shipped to Webhooks, Pull API & Files
Total Processed
11
Target: 90%+ Accuracy, 95%+ Precision

Human Gate: Pending Reviews

5 PENDING
The AI proposes; code validates and flags ambiguities
CVE-2026-119205
Confidence 50%

pypdf has possible infinite loop when cloning dictionaries

Proposed: pkg:pypi/pypdf PURL Fixed: 6.21.4
Evidence Quote: "This has been fixed in pypdf==6.21.4"
CVE-2026-119204
Confidence 50%

pypdf has possible large memory usage when parsing page tree

Proposed: pkg:pypi/pypdf PURL Fixed: 6.21.4
Evidence Quote: "Affected versions < 6.21.4 Patched versions >= 6.21.4"
CVE-2026-119203
Confidence 50%

pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Proposed: pkg:pypi/pypdf PURL Fixed: 6.21.4
Evidence Quote: "Affected versions < 6.21.4 Patched versions >= 6.21.4"
CVE-2026-118759
Confidence 50%

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Proposed: cpe:2.3:a:Kubeflow:Pipelines:*:*:*:*:*:*:*:* CPE Fixed: 2.18.0
Evidence Quote: "Software ghcr.io/kubeflow/kfp-api-server Affected versions <= 2.17.3 Patched versions 2.18.0"
CVE-2026-118761
Confidence 50%

Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Proposed: pkg:golang/Kubeflow Pipelines PURL Fixed: 2.18.0
Evidence Quote: "Affected versions <= 2.17.3 Patched versions 2.18.0"

Delivery Feed: Verified Machine-Matchable Outputs

7 VERIFIED
Direct matchable inputs for security scanners
CVE ID Affected Identifier (CPE / PURL) Type Fixed Version Confidence Actions
CVE-2026-1001 pkg:npm/express-cart PURL 1.3.0
91%
NVD JSON
CVE-2021-44228 pkg:maven/org.apache.logging.log4j/log4j-core PURL 2.15.0
95%
NVD JSON
CVE-2026-3040 pkg:pypi/django PURL 4.2.8
95%
NVD JSON
CVE-2026-1001 pkg:npm/express-cart PURL 1.3.0
91%
NVD JSON
CVE-2021-44228 pkg:maven/org.apache.logging.log4j/log4j-core PURL 2.15.0
95%
NVD JSON
CVE-2026-3040 pkg:pypi/django PURL 4.2.8
95%
NVD JSON
CVE-2026-7777 cpe:2.3:a:fortinet:fortios:*:*:*:*:*:*:*:* CPE 7.4.2
90%
NVD JSON

Audit Event Log & State Machine Transitions

15 EVENTS
Immutable state ledger
Timestamp CVE ID Stage Event Actor Transition
CVE-2026-119205 routed_to_review pipeline init → in_review
CVE-2026-119205 candidates_retrieved pipeline init → retrieving
CVE-2026-119205 extraction_completed pipeline init → extracting
CVE-2026-119205 triage_completed pipeline init → triaged
CVE-2026-119205 cve_ingested cna_feed init → published
CVE-2026-119204 routed_to_review pipeline init → in_review
CVE-2026-119204 candidates_retrieved pipeline init → retrieving
CVE-2026-119204 extraction_completed pipeline init → extracting
CVE-2026-119204 triage_completed pipeline init → triaged
CVE-2026-119204 cve_ingested cna_feed init → published
CVE-2026-119203 routed_to_review pipeline init → in_review
CVE-2026-119203 candidates_retrieved pipeline init → retrieving
CVE-2026-119203 extraction_completed pipeline init → extracting
CVE-2026-119203 triage_completed pipeline init → triaged
CVE-2026-119203 cve_ingested cna_feed init → published