The scanner enriches every finding with why it has that severity, whether it is known to be exploitable, and how it can be exploited (when we have data). This helps you prioritize fixes and spot gaps in testing.
In addition to CVE, Package, Severity, Path, and Remediation, reports include:
| Column | Meaning |
|---|---|
| Exploitable | yes = listed in CISA Known Exploited Vulnerabilities (KEV); no = not in KEV; unknown = offline or non-CVE finding. |
| Why severity | Short explanation of why the finding is Critical/High/Medium/Low (e.g. "Critical: often RCE, auth bypass…"). |
| Exploit info | For KEV items: CISA short description and, when applicable, "Known ransomware campaign use." Otherwise: "Check NVD and vendor advisories." |
Use these to focus first on Exploitable = yes and Severity = CRITICAL.
- When online, the scanner fetches the CISA Known Exploited Vulnerabilities catalog and caches it for 24 hours.
- Any CVE in that catalog is marked Exploitable = yes and its severity is treated as CRITICAL for prioritization (so you don’t miss actively exploited issues).
- Offline (
--offline): we do not fetch KEV; Exploitable is set to unknown and Exploit info is generic.
- Critical — Often RCE, auth bypass, or severe impact; check NVD/CVSS for details.
- High — Significant impact; may allow privilege escalation or data exposure.
- Medium — Moderate impact; may require specific conditions to exploit.
- Low — Limited impact or difficult to exploit.
You can still use NVD/CVSS and vendor advisories to refine prioritization; the "Why severity" text is a quick, consistent explanation from the scanner.
When online, findings that Trivy returns without a CVE ID are queried against the OSV.dev database. If OSV matches a vulnerability, the scanner back-fills the CVE/GHSA ID and adds an OSV advisory link. This catches vulnerabilities in Go modules, npm, PyPI, and other ecosystems that Trivy’s default NVD-only mode may miss. Results are cached in-process. Skipped with --offline.
runc is the container runtime on the host — it never appears as a package inside a scanned image, so Trivy cannot detect it. When --check-runtime is passed, the scanner detects the host runc version (via docker version or runc --version) and checks it against known container escape CVEs:
| CVE | Severity | Fixed in | Description |
|---|---|---|---|
| CVE-2025-31133 | CRITICAL | 1.2.8 | maskedPaths bypass: attacker writes to arbitrary host paths via /dev/null symlink swap |
| CVE-2025-52565 | CRITICAL | 1.2.8 | /dev/console bind-mount escape before LSM protections activate |
| CVE-2025-52881 | CRITICAL | 1.2.8 | LSM bypass via shared mounts; host crash or full breakout |
| CVE-2024-21626 | HIGH | 1.1.12 | LEAKY VESSELS: working directory escape via leaked file descriptor |
Findings appear as normal rows in all report formats with Package=runc and Path=host-runtime.
Use --sbom to generate a CycloneDX JSON SBOM (<baseName>.cdx.json) alongside the vulnerability report. Image scans only. Consumable by Dependency-Track, GitHub Dependency Graph, and DORA compliance tooling.
In online mode, Trivy runs with --detection-priority comprehensive, falling back to GitHub Advisory Database (GHSA) when NVD data is incomplete. This catches Go stdlib and Java stdlib CVEs that the default mode skips silently.
- Baseline run (100+ images): use
go run ./cmd/baselineto scan the full image list. The resulting CSV/Markdown shows Findings and Duration (s) per image so you can see which images or stacks have more issues and where the scanner might be slow or missing coverage. - Exploitable = yes: if your baseline report has many Critical/exploitable items, focus remediation there first; if you see none, that may indicate older or well-patched images—or a need to add more “real-world” images to the list.
- Missing CVEs: the scanner relies on Trivy’s DB, CISA KEV, and OSV.dev. For exploit status beyond KEV, check NVD and vendor advisories (linked in the report).