Present does not mean dangerous
A known flaw in a version tells you what is present. It does not tell you whether your application uses the faulty part, or whether it is exposed. SCA explained simply tells you why.
Vulnerability database
What is hiding in your open-source block?
Find a package, then check the known flaws and fixes for your version.
Choose a suggestion or paste an exact package name (Maven: group:artifact, Go: full module path).
Try:
How to read these results
And for your application?
Tamis does the same across your whole dependency tree, direct and indirect, then sorts what really matters in your case.