OpenSSF publication
Vulnerability Exploitability eXchange
Also known as: VEX
A machine-readable statement asserting whether a known vulnerability affects a given software artifact (and under what conditions). Pairs with SBOM and OSV records to reduce false-positive vuln signal.