Trivy: a row matches a package version to an advisory

The row is a version comparison

Each vulnerability row names a library, the version that was found, an advisory id, a severity, a status, and often a fixed version. The row means: this scan’s inventory included that package at that version, and the advisory database associates that version with that id. It does not mean the vulnerable code path ran, and it does not mean anyone used the advisory against this lab.

Status fixed means the database has a fixed version to show. It does not mean this image already has that version. Compare installed and fixed. If installed is the older one, the fix is available and not present in this scan.

Severity is the database’s label

Severity is the rating carried on the advisory or the distribution’s mapping, as Trivy printed it. It is why a gate might fail. It is not a measurement that this deployment was breached, and it is not a ranking of which host to disconnect.

The same id can be printed differently when the database changes. Write the scan time and the image reference you passed, so the row stays attached to a specific inventory.

What to file

File the image name or path, the scan time, the library, installed version, fixed version, status, severity, and advisory id, copied from the row. File whether unfixed rows were hidden by the command, because a quiet report can mean “nothing matched the filter,” not “nothing is listed.” Do not add a description of how the advisory is abused. The ticket is the upgrade or the accepted exception, not a write-up of the bug.

Worked case: high severity, no incident

The lab image report shows one row: library requests, installed 2.31.0, fixed version 2.32.0, status fixed, severity HIGH, advisory id as printed on that row. A draft says the API was attacked and should be taken offline.

The note quotes the image reference, the scan time, and those cells. It says the inventory contained that version and the database offers a newer one. It does not say the defect was exercised. The action in the ticket is to rebuild with the fixed version or to record an exception with a review date. The severity explains why the gate failed. It is not an incident category.

image: ghcr.io/hackblue-lab/api:lab
scanned: 2026-11-03T18:00:00Z
library: requests  installed: 2.31.0  fixed: 2.32.0
status: fixed  severity: HIGH
advisory: id as printed on the row
supports: this inventory matched that advisory
does not support: an attack against the lab