How do you determine if a vulnerability is an OS vulnerability or application vulnerability? I need to verify which are strictly for OS


How do you determine if a vulnerability is an OS vulnerability or application vulnerability? I need to verify which are strictly for OS.