OSPS-VM-04 Publish Discovered Vulnerabilities (maturity levels 2, 3). Requirement: The project documentation MUST publicly publish data about discovered vulnerabilities. Objective of the control: Ensure that project end users have a well known mechanism to understand vulnerabilities found within the project. Recommendation: Provide information about known vulnerabilities in a predictable public channel, such as a CVE entry, blog post, or other medium. To the degree possible, this information should include affected version(s), how a consumer can determine if they are vulnerable, and instructions for mitigation or remediation.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.