Vulnerability Disclosure Report
Communicates known (and previously unknown) vulnerabilities inherited from third-party and first-party inventory.
Spec focus
vulnerabilities[], affects[], ratings[]
Graph labels
BomDocument, Vulnerability, Component
Lifecycle
post-build
Mapping. Each vulnerabilities[] item is a :Vulnerability. affects[].ref becomes AFFECTS to a Component or Service.
Extension. Because inventory lives in the same graph, blast-radius queries hop from CVE → component → dependents → hardware device.
Documents
HarborPulse VDR 2026-Q1
urn:uuid:7a2e1c90-aa11-4b33-9d01-vdr00008
Subject — · v1 · 2026-03-21T10:00:00Z
Open in graphNeighborhood
Drag to pan · scroll to zoom · 10 nodes · 9 edges
Select a node to inspect CycloneDX properties.
Sample Cypher
All BOM documents
Every CycloneDX document in the Atlas graph, with its type.
Disclosed vulnerabilities
VDR findings and the components they affect.
Components shared across BOM types
Inventory that appears in more than one BOM variety — the knowledge-graph payoff.
Knowledge concept overlay
How CycloneDX instances map onto the Atlas ontology.
Graph size by label
How many Atlas nodes exist for each CycloneDX class.
Neighborhood of HarborPulse API
One- and two-hop context around the application component.
Known vulnerabilities affecting components or services.