Grype: the vulnerability id is the advisory

The id names the advisory

A row can show a vulnerability id such as a lab advisory id. That id is the advisory the database matched. It is not the name of the package, and it is not the name of the image.

Opening the advisory explains the advisory. It does not list every package in your SBOM.

The package is the other field

The artifact or package field is what the scan or SBOM contained for this match. One advisory can match one package on this row. Another package would be another row, even under the same advisory id.

If the package field is missing, write “package not on this row.” Do not put the advisory id in that blank.

What to file

File the vulnerability id, the package name, the installed version if present, and the SBOM or image the row came from. A fix version, if present, stays a separate field. Do not rename the advisory as the package.

Worked case: an advisory id used as the package

A lab row shows vulnerability LAB-2026-0099 and package lab-widget. A draft says the SBOM contains a package named LAB-2026-0099 and does not mention lab-widget.

The note quotes LAB-2026-0099 as the advisory and lab-widget as the package. The SBOM package is lab-widget. The advisory id is not a package name.

Snippet

sbom: lab-widget.cdx.json
vulnerability: LAB-2026-0099
package: lab-widget
write: advisory and package
not: a package named LAB-2026-0099

Diagram

Keep the advisory off the package name

Vulnerability id
The advisory on this row.
Advisory
```
LAB-2026-0099
```
Package
The artifact that matched.
Name
```
lab-widget
```
Another package
Would be another row.
Row
```
not this name
```
The note
Do not swap the two strings.
Note
```
id is not the package
```

Check yourself

1. A row shows vulnerability LAB-2026-0099 and package lab-widget. What is LAB-2026-0099?

2. The same advisory id appears on a second row with a different package. What do you have?

3. The package field is empty. What do you write?