VEX
Vulnerability Exploitability eXchange — machine-readable format where the vendor states "this CVE in our SBOM does NOT apply / is fixed / is under investigation". Cuts away false positives from CVE scanners.
Motivation: an SBOM lists all code including transitive deps; the CVE scanner triggers on every match. The reality is often that your code doesn't CALL the vulnerable function. VEX lets the vendor say "not_affected — the vulnerable function isn't used". Status values: not_affected, affected, fixed, under_investigation. Formats: CSAF (OASIS, XML/JSON), OpenVEX (CNCF, minimal JSON), CycloneDX-embedded. Drives modern SCA tools to distinguish "possible" from "actual" exposure.