# Detecting vulnerabilities (CVEs)

You may detect which artifacts (Standard Jobs, Big Data Jobs, Routes) affected by Common Vulnerabilities and Exposures (CVEs) have been fixed since the latest Talend Studio update has been released.

Due to technical limitation:

* The CVEs for the jars with the Talend-specific groupIds org.talend.libraries cannot be detected.
* The CVEs for the jars used by Talend Studio but not by any component cannot be detected.
* The CVEs for the artifacts built as OSGI Bundle or Microservice in the report are not accurate.

## Procedure

1. Click File > Edit Project Properties from the menu bar to open the Project Settings dialog box.
2. Click Audit to open the corresponding view.
3. In the From Version field, select from which Talend Studio update you want to compare and build the CVE report.

   ![Project Settings dialog box.](https://help.qlik.com/talend/en-US/studio-user-guide/Resources/images/studio-detect-cve.png)
4. Click Generate CVE report.

   ![CVE detect wizard.](https://help.qlik.com/talend/en-US/studio-user-guide/Resources/images/studio-detect-cve-check-report.png)

   The CVE detect wizard pops up, indicating that the CVE detect completed successfully. A CSV report file <timestamp>\_<project-name>\_CVE\_Report.csv is generated under the directory <Talend-Studio>\workspace\report\CVEReport\_<timestamp>, where <timestamp> designates when the report is generated and <project-name> designates the name of your project. Click Browse... to go to the directory.

   The table below describes the information presented in the report file.
   | Column name | Description |
   | --- | --- |
   | Status | Can be:<br><br><ul> <li><span>Upgraded</span>: The vulnerability has been                                    fixed by upgrading the library to a new version</li> <li><span>Removed</span>: The vulnerability has been                                    fixed by removing the library from the                                    component/distribution/studio plugin dependencies</li> </ul> |
   | Fix Version | The update version when the CVE has been fixed.<br><br>Example:<br>R2022-03 |
   | Project Name | Name of the project impacted by the Common Vulnerabilities and<br>Exposures.<br><br>Example: LOCAL\_PROJECT |
   | Item type | Type of the artifact impacted by the Common Vulnerabilities and<br>Exposures.<br><br>Example: PROCESS |
   | Item ID | Identifier of the artifact impacted by the Common Vulnerabilities<br>and Exposures.<br><br>Example:<br>\_GXOmQFizEeiOq-rLS\_Z-8g |
   | Item Name | Display name of the artifact impacted by the Common<br>Vulnerabilities and Exposures.<br><br>Example:<br>MyVeryComplexJob |
   | GAV with CVE | The Maven Group, Artifact, Version (GAV) of the JAR file that has<br>unsolved vulnerabilities.<br><br>Example:<br>org.apache.logging.log4j:log4j-core:2.13.2 |
   | GAV with CVE mitigated | The Maven Group, Artifact, Version (GAV) of the JAR file that has<br>fixed vulnerabilities.<br><br>Example:<br>org.apache.logging.log4j:log4j-core:2.17.1 |
   | UsedByTalendComponent | Can be:<br><br><ul> <li><span>True</span>: The GAV with CVE has been fixed in                                    the listed components but is still used by <span>Talend Studio</span> somewhere else.</li> <li><span>False</span>: The GAV with CVE has been                                    completely removed from the <span>Talend Studio</span> component dependencies.</li> </ul> |
   | CVE-ID | Identifier of the Common Vulnerabilities and Exposures. If not<br>available, you will get CVE-NOT\_DISCLOSED.<br><br>Example:<br>CVE-2021-44228 |
   | CVSS | The CVSS (Common Vulnerability Scoring System) score for rating<br>the severity of security vulnerabilities in software. It can be<br>between 0.0 and 10.0, with<br>10.0 being the most severe. For more information<br>about CVSS, see https://nvd.nist.gov/vuln-metrics/cvss. |
   | Component Names | Name of the component impacted by the Common Vulnerabilities and<br>Exposures. It can be the technical name used for code generation, or<br>it can be studio if it impacts the whole Talend Studio. |
   | Comment | Additional comments. |

   You can also detect the fixed CVEs of your artifacts while building using CI. For more information, see [Detecting the fixed vulnerabilities (CVEs) of your artifacts while building](https://help.qlik.com/talend/en-US/software-dev-lifecycle-best-practices-guide/8.0/detecting-cve-while-building).

### In this section

* [Percentage of undetected dependencies in the CVE reports](https://help.qlik.com/talend/en-US/studio-user-guide/8.0-R2026-09/percentage-of-undetected-dependencies)