Ignoring Vulnerabilities that are still under investigation

[Naphier]

We have a few alerts where the vulnerabilities are listed as "under investigation" on nvd.nist.gov
We'd like to ignore any vulnerability where the criticality is unknown.
Is there a recommendation on how to do this?

[postmodern]

Could you give an example CVE? Are you referring to when the CVE does not have a CVSS base score yet?

[Naphier]

We've found another way to deal with this. Sorry for the question with lack of details but I don't have an example I can share because of company security policy. I'll close this out. Thanks for the quick response!

[postmodern]

Also ignoring CVEs that are under investigation or contested is a gamble. Depending on the type of vulnerability, it might end up being very severe, but might not have a CVSS base score yet because no one has gotten around to it yet. Always update vulnerable gems or somehow mitigate the vulnerabilities.