# Vulnerabilities The **Vulnerability Management** tab of [Microsoft Security View](https://wiki.cyberguard.srl/cat/microsoft-security-view.md) lists the software vulnerabilities that Microsoft Defender Vulnerability Management has found on your devices. To keep the list focused on what really matters, it shows only vulnerabilities **with a public exploit** — the ones attackers can use today — and excludes mobile devices. Not all of them weigh the same: each CVE is matched against the CISA catalog of known exploited vulnerabilities (KEV), so the ones attackers are actively exploiting come first.  ## What You See Four indicators summarize the situation: | Indicator | What it shows | | --- | --- | | **Open CVEs** | The open vulnerabilities, by severity. | | **Actively exploited** | The open CVEs in the CISA KEV catalog — fix these first — and how many of them are used by ransomware. | | **Affected devices** | The devices with at least one open CVE, by platform, and the most exposed one. | | **Resolved in the last 30 days** | The vulnerabilities resolved recently, week by week. | The table has **one row per CVE**, sorted by priority: actively exploited first, then critical. For each CVE you see: - the **CVE** and its **severity** with the CVSS score; - the **exploitation**: **Exploited** and **Ransomware** badges, since when the CVE is in the KEV catalog, and the probability that it will be exploited in the next 30 days (EPSS); - the affected **product**; - the number of **devices**: click it to open the list of devices with platform, installed version and remediation; - the **remediation** suggested by Microsoft, typically the security update to install; - the **status** (open or resolved) and when it was detected or resolved. Filter by text, severity, status and platform, or use the **Exploited (KEV)** and **Ransomware** quick filters. Next to the table, the charts **By severity and exploitation**, **Products with the most open CVEs** and **Most exposed devices** filter the list with one click. The page shows when the data was last updated and when the next automatic update is scheduled; **Refresh now** updates it immediately. If the KEV catalog cannot be reached, the page says so and the exploitation column stays empty. ## Using the List 1. Start from the top: the actively exploited CVEs, and among them the ones used by ransomware. 2. Then the critical ones, starting from the products and devices the charts show as most exposed. 3. Group them by remediation: one security update often closes several CVEs on several devices. 4. Apply the updates, then check the **Resolved** status after the next update of the data. 5. Record what you did in the [Workspace](https://wiki.cyberguard.srl/cat/workspace.md), in the **Vulnerabilities** area.