Vulnerabilities

Security → Vulnerabilities (/gravity/security/vulnerabilities) lists known vulnerabilities (CVEs) found in the container images your cloud instances are running, so you can triage them without leaving the platform.

Where findings come from

Sencai scans the container images used by your active cloud instances with Trivy (falling back to Grype), and writes one row per finding: the image, the CVE ID, the affected package and version, a fix version if one exists, and severity.

Note

This is image scanning, not a general host CVE feed. If you’re looking for outdated OS packages on a fleet-enrolled server, that’s covered separately - see Patching.

Caution

Automatic scanning has to be turned on for your environment before findings appear here. If this screen is empty and you expect findings, ask your account team to confirm scanning is active for your instances rather than assuming there’s nothing to find.

Severity model

Findings are labeled Critical, High, Medium, or Low, matching the severity Trivy/Grype assigns to the underlying CVE. Use the severity filter chips at the top of the table to narrow the list - each chip shows a live count.

Reading the table

Column	Meaning
Image	The container image the finding was found in
CVE ID	The vulnerability identifier
Package / Version	The affected package and the version in the image
Fix Version	The version that resolves it, if the scanner found one
Severity	Critical / High / Medium / Low
Status	Open, Accepted, or Fixed
Scanner	Which tool produced the finding (Trivy or Grype)
Scanned	When the image was last scanned

Triage workflow

Each open finding has two possible actions:

• Accept Risk - marks the finding as Accepted. Use this when you’ve reviewed a finding and decided not to act on it right now (for example, the affected code path isn’t reachable in your deployment). This is a one-click action today - it doesn’t currently prompt you for a written justification, so if your organization needs a documented reason, record it separately (for example, as a note on the related change or ticket).
• Mark Fixed - available on both Open and Accepted findings. Use it once you’ve rebuilt or replaced the image with a version that resolves the CVE.

There’s no bulk action - findings are triaged one at a time, which keeps the audit trail specific to each decision.

How findings relate to patches

This screen covers container images, not the operating system packages installed on your fleet-enrolled hosts - those are tracked separately under Patching. If a finding here points to a base-image package rather than something your own build introduced, the fix is usually to rebuild from an updated base image rather than patching a running container in place.

Container images themselves - the ones this scanner looks at - come from your connected registries; see Container registry for how images get into Sencai in the first place.

What’s next

• Patching - outdated OS packages on your fleet hosts
• Container registry - where the scanned images come from
• Secret findings - leaked credentials, a different kind of finding entirely
• Audit log - every Accept Risk / Mark Fixed decision is recorded there