Which LLM should score your CVEs?
Your scanner finds 400 CVEs. Most don't matter for your system, but the CVSS score can't tell you which: it rates the bug, not your setup.
Blog¶
vens-action: reranking Trivy/Grype CVEs by real risk in CI
If you run Trivy or Grype in CI and triage the output by CVSS, this is the thing I wish I'd had two years ago.
Stop patching vulnerabilities that don't matter to you
Monday, 9 AM, coffee in hand. You open the Trivy report: 107 vulnerabilities. You sort by CVSS, a 9.8 CRITICAL sits at the top, and the emergency meeting starts.