> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kikimora.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerabilities overview

> Kikimora's central repository for security findings — where they come from, the statuses they move through, and how severity, Kikimora Score, and time to resolve are defined.

The **Vulnerabilities** module is Kikimora's central repository for security findings. It continuously aggregates flaws and exposures from every source the platform has: automated web application scans such as Qualys, endpoint monitoring agents such as Wazuh, external exposure discovery engines, and manual security testing.

Editing a finding that originated from a web scan or agent does not create a duplicate. On subsequent scans, Kikimora updates the existing entry instead.

## Lifecycle and statuses

Each vulnerability moves through a lifecycle marked by a colored status badge:

| Status             | Badge color    | Meaning                                                              |
| :----------------- | :------------- | :------------------------------------------------------------------- |
| **Open**           | Yellow         | Active finding identified, awaiting triage or remediation.           |
| **In Progress**    | Orange / Blue  | Remediation is underway by the assigned owner or security team.      |
| **Closed**         | Gray / Slate   | Resolved or mitigated, verified by automated rescan or manual check. |
| **False-Positive** | Blue / Neutral | Confirmed invalid or non-threatening in this environment.            |

## Severity and impact

Findings are graded into standard impact levels from their CVSS score:

| Impact   | CVSS range |
| :------- | :--------- |
| Critical | 9.0–10.0   |
| High     | 7.0–8.9    |
| Medium   | 4.0–6.9    |
| Low      | 0.1–3.9    |
| Info     | 0.0        |

## Kikimora Score

The **Kikimora Score** refines standard CVSS metrics with asset criticality, exposure, active threat intelligence, and environment context — so two findings that share a CVSS score can rank very differently in your environment.

## Time to Resolve

**Time to Resolve** (TTR) measures the elapsed duration between a vulnerability's first detection and its closure. Use it to track SLA compliance and remediation efficiency.

## Related modules

* [Web applications](/web-applications/index)
* [Manual tests](/manual-tests/index)
* [Scans](/scans/index)
* [Risk management](/risk-management/index)
* [Endpoints](/endpoints/index)