# A purl of wisdom on SBOMs and vulnerabilities

DevFeed: [A purl of wisdom on SBOMs and vulnerabilities](<https://devfeed.tech/articles/a-purl-of-wisdom-on-sboms-and-vulnerabilities-12860.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/a-purl-of-wisdom-on-sboms-and-vulnerabilities>)

Published: 2023-02-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [component](<https://devfeed.tech/tags/component.md>), [components](<https://devfeed.tech/tags/components.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [false-positive](<https://devfeed.tech/tags/false-positive.md>), [nvd](<https://devfeed.tech/tags/nvd.md>), [package-url](<https://devfeed.tech/tags/package-url.md>), [purl](<https://devfeed.tech/tags/purl.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

## AI overview

The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%.

## Source excerpt

SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%.