<![CDATA[Vulnerability scanning]]>I am evaluating enterprise. Real detection engine, but its database doesn't fully overlap with NVD/Trivy, and its client-facing warnings are a periodic snapshot rather than real-time (re-verified). Live blocking, separately, is real-time.
Coverage gap
Microsoft.Build.Tasks.Core 17.7.2 → CVE-2025-26646 (HIGH per NVD, already known from our existing Trivy-based scanning) was not present at all in ProGet's database. Re-confirmed with the same isolated, ProGet-only source.

]]>https://forums.inedo.com/topic/5834/vulnerability-scanningRSS for NodeTue, 15 Sep 2026 09:29:35 GMTMon, 14 Sep 2026 20:19:14 GMT60<![CDATA[Reply to Vulnerability scanning on Tue, 15 Sep 2026 09:11:43 GMT]]>Hi @sai.pabbareddy ,

I'm not really sure what question you're asking?

CVE-2025-26646 has been in Inedo's database as PGV-2535204 since May 13, 2025.

However, under the default risk profile in ProGet, we rate this a Category 1 since there is effectively no risk posed by this vulnerability. It requires a malicious inside actor with access to modify the source code -- which is not a realistic threat actor.

As such, ProGet will not not "spam" developers via the NuGet client with needless warnings. This is all by design.

You can learn more about that here: https://guides.inedo.com/vulnerability-management/categories/

Thanks,
Alana

]]>https://forums.inedo.com/post/20026https://forums.inedo.com/post/20026Tue, 15 Sep 2026 09:11:43 GMT