Abstract: Example implementations relate to creating a vulnerability state report. An example non-transitory machine-readable medium can include instructions executable to determine information associated with a device. The information can include firmware information, device model information, and security bulletin information. The example non-transitory machine-readable medium can include instructions executable to combine the information to determine a vulnerability state of the device and create a report of the vulnerability state of the device. The report can include comprising information associated with the vulnerability state and associated security bulletin information.