Risk Monitor can ingest Common Vulnerabilities and Exposures (CVEs) from CSV files. This article explains how CSV uploads are processed and how the system determines which vulnerabilities to track.

When a CSV file is uploaded, Risk Monitor checks each CVE against the National Vulnerability Database (NVD).

• A CVE is only added to tracking and reporting if the NVD has an official link between that vulnerability and the affected software or product.
• If a CVE is not linked in the NVD, it will not be ingested, even if it is listed in other sources or included in your CSV.

You can search for CVEs in the NVD at: https://nvd.nist.gov/vuln/search