video1.0<iframe src="https://www.loom.com/embed/a5913a0979c24d238f71d3673c8c98bc" frameborder="0" width="3794" height="2845" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>28453794Loomhttps://www.loom.com28453794https://cdn.loom.com/sessions/thumbnails/a5913a0979c24d238f71d3673c8c98bc-51400947e0067230.gif215.581This Loom explains how expanding evidence and CVE tracking can improve vulnerability remediation when CVEs are caused by embedded dependencies. It notes that a known CVE and root cause may appear inside other applications, such as SQLite embedded in software like Microsoft ToDos and NordVPN, or issues related to components like OpenSSL. The speaker says the approach identifies the affected containing applications, indicates whether patching can remediate the issue, and flags cases where no fix may exist. They also mention an upcoming option to remediate directly from a CVE into the affected applications, and the plan to expand this coverage in the coming weeks.