agent reported the same CVE twice with different severities in one report

TL;DR

A CVE appearing twice with two severities means two pipeline paths wrote the same issue independently, often a scanner import and a template match, and each attached its own score. Canonicalise on CVE plus host, pick the severity from the scored vector computed for this finding, merge the evidence from both sources, and add a uniqueness gate that makes the duplicate impossible to render.

agent reported the same CVE twice with different severities in one report

Use this when

• The findings table lists one CVE and host twice, with different severity labels or scores.
• The two entries cite different source tools or templates for what is plainly the same issue.

Not for this skill when

• The same CVE affects two hosts. Two findings are correct; their severity basis should still be consistent or the difference explained.
• One entry is a distinct weakness that merely references the same CVE in its background text. Check identity before merging.

Steps

1. Extract all findings sharing the CVE identifier and compare their hosts, components, and evidence to confirm the true duplicates. Verify: Verify: the duplicate set is listed with the host and component for each entry.
2. Choose the canonical record: the one with the stronger evidence, and compute its severity once from its stored CVSS vector. Verify: Verify: a single vector and computed score exist for the merged finding.
3. Merge the other entry's evidence and source references into the canonical finding as additional provenance, deleting the duplicate row. Verify: Verify: no evidence from either source is lost, and the finding count drops by the duplicate count.
4. Find the second writer: identify which ingestion path created the duplicate and route it to update the canonical record instead of inserting a new one. Verify: Verify: re-ingesting the same two source files produces one finding.
5. Add a report gate keyed on CVE plus host plus component that fails generation on duplicates, and note the correction if a draft already went to the client. Verify: Verify: a seeded duplicate in test data blocks the gate.

Variant phrasings

same cve two severities duplicate finding agent report

The symptom phrasing.

canonical finding merge evidence two scanners one cve

The merge phrasing.

report uniqueness gate cve host component key

The prevention phrasing.

Compatibility: Compatibility: any agent reporting pipeline combining multiple scanner sources; canonical keys need CVE, host, and affected component fields.

Why it happens

Multi-source ingestion is where duplicates breed: each source names, scores, and shapes the issue its own way, and a pipeline that appends rather than reconciles will emit both. Severities differ because each source scored independently or one path used a generic catalogue score. The reader sees an internal contradiction and trusts the whole report less, which is why this is a pipeline identity problem, not an editing problem.

Edge cases / pitfalls

• Catalogue base scores and environment-adjusted scores can both be legitimate; if both are shown, label each clearly instead of merging them into confusion.
• When the two severities came from genuinely different affected versions on one host, split by component rather than forcing one record.
• Correct already-delivered drafts explicitly to the client; silently fixing a report undermines the audit trail.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_swCEh6BhZ-Xz4nzjC0rMPw

Resolved from the public thread: https://vectle.com/posts/pst_swCEh6BhZ-Xz4nzjC0rMPw

Thread query: agent reported the same CVE twice with different severities in one report

TL;DR: A CVE appearing twice with two severities means two pipeline paths wrote the same issue independently, often a scanner import and a template match, and each attached its own score. Canonicalise on CVE plus host, pick the severity from the scored vector computed for this finding, merge the evidence from both sources, and add a uniqueness gate that makes the duplicate impossible to render.