# When the CVE List Is Updated

> When CapaOne updates the CVEs it shows, and how long a CVE stays listed after you update the vulnerable software.

Source: https://docs.capaone.com/capaone/security-monitor/when-the-cve-list-is-updated/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Security Monitor finds CVEs by comparing the software on your endpoints with the NIST CVE database.
The CVE list isn't real-time. A CVE disappears when CapaOne has checked the endpoint's new software
inventory, not at the moment you update the software.

## When CapaOne checks an endpoint for CVEs

CapaOne checks an endpoint for CVEs each time the CapaOne Agent sends a new software inventory. The
agent sends one:

- About once a day.
- When CapaOne has installed, updated, or uninstalled an application on the endpoint.
- When you request a software scan. See [Remove a CVE sooner](#remove-a-cve-sooner).

Once a day, CapaOne also downloads the latest CVE data and checks all endpoints again. Newly
published CVEs appear after this check.

## What to expect after you update software

How soon a CVE disappears depends on how the software was updated:

| How the software was updated | When the CVE disappears |
|---|---|
| With CapaOne, for example as a Repository App or a Company App | Usually within a few minutes after the installation completes. |
| Outside CapaOne, for example by the application's own updater | After the endpoint's next daily software scan, usually by the next day. |

If several applications are queued for the endpoint, the scan runs after the last one completes. An
offline endpoint is scanned when it's online again.

The views under **Windows → Security** don't all update at the same time:

- The endpoint's **Software** and **Detected CVEs** views update first. Their **Collected on**
  timestamp shows when the endpoint was last checked for CVEs.
- The **Affected Endpoints**, **Affected Software**, and **Detected CVEs** tabs follow within 15
  minutes. Their **Generated on** timestamp shows when they were last updated.
- **Overall Exposure** and the **CVEs by Severity (30 days)** chart on the **Vulnerabilities** tab
  are calculated once a day. A CVE you fix today is counted as **Eliminated** after the next daily
  check.

## Remove a CVE sooner

If the software was updated outside CapaOne, request a new software inventory instead of waiting for
the daily scan:

1. Go to **Windows → Endpoints → List** and click the endpoint's name.
2. Open the actions menu (⋮) in the endpoint header and select **Request → Scan software**.

CapaOne checks the endpoint for CVEs when the scan completes.

To scan several endpoints, select them in the endpoint list and select **Scan software** in the
actions menu. Only online endpoints are scanned. See
[Windows Endpoint List](/capaone/windows-management/windows-endpoint-list/#act-on-many-endpoints).

Use **Scan software**, not **Scan security**. **Scan security** doesn't collect a new software
inventory, so it doesn't pick up the new version.

## If the CVE is still listed

If the CVE is still listed after a software scan:

- Check the application's version on the endpoint's **Inventory → Software** tab. If the old version
  is listed, the update didn't install.
- Look for other installations of the application, such as an older version installed for a single
  user. Each installation is checked on its own.
- Open the CVE and read its details. The vulnerability might also affect the new version.

## Related

- [Security Dashboard](/capaone/security-monitor/security-dashboard/)
- [Endpoint Security](/capaone/security-monitor/endpoint-security/)
- [Send Requests to a Windows Endpoint](/capaone/windows-management/send-requests-to-a-windows-endpoint/)