Struct VulnerabilityDetail 

pub struct VulnerabilityDetail {

    pub id: String,
    pub source: String,
    pub severity: String,
    pub cvss_score: Option<f32>,
    pub component_id: String,
    pub component_canonical_id: Option<CanonicalId>,
    pub component_ref: Option<ComponentRef>,
    pub component_name: String,
    pub version: Option<String>,
    pub cwes: Vec<String>,
    pub description: Option<String>,
    pub remediation: Option<String>,
    pub is_kev: bool,
    pub component_depth: Option<u32>,
    pub published_date: Option<String>,
    pub kev_due_date: Option<String>,
    pub days_since_published: Option<i64>,
    pub days_until_due: Option<i64>,
    pub vex_state: Option<VexState>,
}

Detailed vulnerability information

Fields

id: String

Vulnerability ID

source: String

Source database

severity: String

Severity level

cvss_score: Option<f32>

CVSS score

component_id: String

Affected component ID (string for serialization)

component_canonical_id: Option<CanonicalId>

Typed canonical ID for the component (skipped in JSON for backward compat)

component_ref: Option<ComponentRef>

Component reference with ID and name together

component_name: String

Affected component name

version: Option<String>

Affected version

cwes: Vec<String>

CWE identifiers

description: Option<String>

Description

remediation: Option<String>

Remediation info

is_kev: bool

Whether this vulnerability is in CISA’s Known Exploited Vulnerabilities catalog

component_depth: Option<u32>

Dependency depth (1 = direct, 2+ = transitive, None = unknown)

published_date: Option<String>

Date vulnerability was published (ISO 8601)

kev_due_date: Option<String>

KEV due date (CISA mandated remediation deadline)

days_since_published: Option<i64>

Days since published (positive = past)

days_until_due: Option<i64>

Days until KEV due date (negative = overdue)

vex_state: Option<VexState>

VEX state for this vulnerability’s component (if available)

Implementations

impl VulnerabilityDetail

pub fn is_vex_actionable(&self) -> bool

Whether this vulnerability is VEX-actionable (not resolved by vendor analysis).

Returns true if the VEX state is Affected, UnderInvestigation, or absent. Returns false if the VEX state is NotAffected or Fixed.

pub fn from_ref(vuln: &VulnerabilityRef, component: &Component) -> Self

Create from a vulnerability reference and component

pub fn from_ref_with_depth( vuln: &VulnerabilityRef, component: &Component, depth: Option<u32>, ) -> Self

Create from a vulnerability reference and component with known depth

pub fn sla_status(&self) -> SlaStatus

Calculate SLA status based on KEV due date or severity-based policy

Priority order:

1. KEV due date (CISA mandated deadline)
2. Severity-based SLA (Critical=1d, High=7d, Medium=30d, Low=90d)

pub fn get_component_id(&self) -> CanonicalId

Get the typed component canonical ID

pub fn get_component_ref(&self) -> ComponentRef

Get a ComponentRef for the affected component

Trait Implementations

impl Clone for VulnerabilityDetail

fn clone(&self) -> VulnerabilityDetail

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VulnerabilityDetail

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for VulnerabilityDetail

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for VulnerabilityDetail

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.