What happened:
The output from grype is indicating vulnerabilities, but none are getting listed in the CLI output.
What you expected to happen:
List all the vulnerabilities
How to reproduce it (as minimally and precisely as possible):
(The example image I have requires a chainguard subscription to access, I could not find a public available chainguard iamguarded image to demonstrate this)
Example image from: https://images.chainguard.dev/directory/image/mongodb-iamguarded/versions
$ grype --platform linux/amd64 cgr.dev/chainguard/mongodb-iamguarded:latest
✔ Pulled image
✔ Loaded image cgr.dev/chainguard/mongodb-iamguarded:latest
✔ Parsed image sha256:6b3d7b3fced370ff00dd03432a5a4c27010381a1dab0a548564f23b3839a80c0
✔ Cataloged contents 1e829b1f288a3a3f17a33948d756a00dacf1ff9a176e1a9072d6fd95599fe252
├── ✔ Packages [320 packages]
├── ✔ Executables [183 executables]
├── ✔ File metadata [892 locations]
└── ✔ File digests [892 files]
✔ Scanned for vulnerabilities [0 vulnerability matches]
├── by severity: 56 critical, 16 high, 32 medium, 3 low, 0 negligible
└── by status: 107 fixed, -107 not-fixed, 0 ignored
Note the negative not-fixed.
If I output the json or html, the vulnerabilities can be seen, and the the vulnerabilities not being displayed are:
- GO-2026-5005 (Critical, fixed)
- GO-2026-5006 (Critical, fixed)
- GO-2026-5017 (Critical, fixed)
- GO-2026-5019 (Critical, fixed)
- GO-2026-5020 (Critical, fixed)
- GO-2026-5021 (Critical, fixed)
- GO-2026-5023 (Critical, fixed)
- GO-2026-5013 (High, fixed)
- GO-2026-5018 (High, fixed)
- GO-2026-5014 (Medium, fixed)
- GO-2026-5015 (Medium, fixed)
- GO-2026-5016 (Medium, fixed)
- GO-2026-5033 (Medium, fixed)
- GO-2026-5024 (Low, fixed)
Anything else we need to know?:
Environment:
- Output of
grype version: grype 0.114.0
- OS (e.g:
cat /etc/os-release or similar): MacOS 26.5.1 (latest)
What happened:
The output from grype is indicating vulnerabilities, but none are getting listed in the CLI output.
What you expected to happen:
List all the vulnerabilities
How to reproduce it (as minimally and precisely as possible):
(The example image I have requires a chainguard subscription to access, I could not find a public available chainguard iamguarded image to demonstrate this)
Example image from: https://images.chainguard.dev/directory/image/mongodb-iamguarded/versions
$ grype --platform linux/amd64 cgr.dev/chainguard/mongodb-iamguarded:latest ✔ Pulled image ✔ Loaded image cgr.dev/chainguard/mongodb-iamguarded:latest ✔ Parsed image sha256:6b3d7b3fced370ff00dd03432a5a4c27010381a1dab0a548564f23b3839a80c0 ✔ Cataloged contents 1e829b1f288a3a3f17a33948d756a00dacf1ff9a176e1a9072d6fd95599fe252 ├── ✔ Packages [320 packages] ├── ✔ Executables [183 executables] ├── ✔ File metadata [892 locations] └── ✔ File digests [892 files] ✔ Scanned for vulnerabilities [0 vulnerability matches] ├── by severity: 56 critical, 16 high, 32 medium, 3 low, 0 negligible └── by status: 107 fixed, -107 not-fixed, 0 ignoredNote the negative not-fixed.
If I output the json or html, the vulnerabilities can be seen, and the the vulnerabilities not being displayed are:
Anything else we need to know?:
Environment:
grype version:grype 0.114.0cat /etc/os-releaseor similar): MacOS 26.5.1 (latest)