A combined vulnerability snapshot
FedRAMP calls this artifact Historical Vulnerability Evaluation and Reporting Activity. The worked pair combines three synthetic active vulnerability records and three synthetic accepted vulnerability records in one generated snapshot.
The active collection carries detection, reachability, exploitability, evaluation, description, and rating fields. The accepted collection carries similar technical context plus acceptance rationale and senior-official acceptance. Keeping those groups separate lets consumers distinguish findings progressing through response work from risks being carried through an explicit acceptance decision. JSON is suited to automated retrieval, inventory reconciliation, and change detection; HTML makes the same snapshot readable without a consuming system.
What history means here
Use this example to design questions a retrieval workflow should answer: Which records are new? Which changed rating or disposition? Did an active item become accepted? Is an accepted item still present at the next cutoff? Does the human-readable output match the API response?
The included file is a point-in-time aggregation, not a complete event ledger. It does not independently show every transition, rating change, mitigation, closure, or removal before generation. A production historical service may need dated snapshots, immutable change events, stable identifiers, and reconciliation rules so reviewers can reconstruct how each record evolved. Applicability and update cadence vary by Certification Class; confirm current requirements instead of inferring a cadence from this one dated example.
Synthetic example and current status
All vulnerabilities, timestamps, components, ratings, acceptance rationales, decisions, and officials in these 2026-07-27 files are fictional. The pair is not an export of Boundera's live vulnerability-management or production-security systems. Use the official FedRAMP Marketplace record for current information.