Issues

• Debian kernel CVEs not reported for signed kernel packages (source linux-signed-amd64)

  bugfalse-positive
  anchore/grype#3877 · Filter by author pplatanias opened on Nov 2, 2026
  2

• CVE-2026-91403 reported in error against RedHat JDK (java-25-openjdk-headless 1:25.0.5.0.8-1.0.el10)

  bug
  anchore/grype#3866 · Filter by author JackPGreen opened on Oct 30, 2026
  1

• False positive: Homebrew imagemagick 7.1.2-34 matched by CVE-2023-5341 (< 7.1.2) — patch-level suffix compared as pre-release

  anchore/grype#3865 · Filter by author jxman opened on Oct 30, 2026
  2

• VEX ignore rules skip their package, fix-state and match-type conditions

  anchore/grype#3864 · Filter by author vertisan opened on Oct 30, 2026

• db-search JSON schema is out of date on main and schema drift checks never run in CI

  anchore/grype#3862 · Filter by author vertisan opened on Oct 30, 2026

• Configuration descriptions and yaml tags are out of sync with how grype reads its config

  anchore/grype#3861 · Filter by author vertisan opened on Oct 30, 2026

• Report Red Hat Severity for Red Hat Hummingbird images and rpms

  enhancement
  anchore/grype#3859 · Filter by author prarit opened on Oct 29, 2026
  1

• How to import Spring's CVE Feeds into Local Grype CVE database

  anchore/grype#3851 · Filter by author Saloni899 opened on Oct 27, 2026

• CSAF VEX documents that declare product groups are silently ignored

  bug
  anchore/grype#3844 · Filter by author imh0st opened on Oct 25, 2026
  1

• grype db list outputs invalid JSON

  bug
  anchore/grype#3843 · Filter by author maximiliankolb opened on Oct 25, 2026
  1

• False negatives when scanning an SBOM containing CPEs that utilize the 'update' field

  bug
  anchore/grype#3842 · Filter by author kyle-ni opened on Oct 24, 2026
  1

• ci: set persist-credentials: false in release workflow to reduce credential exposure window

  anchore/grype#3830 · Filter by author javier20dev25 opened on Oct 22, 2026
  1

• False positive: CVE-2026-113344 Chrome fixed-version transposition (8078 vs 8087)

  bugfalse-positive
  anchore/grype#3829 · Filter by author flaviovilarinho opened on Oct 22, 2026
  1

• Grype memory grows without bound on CycloneDX SBOMs that contain many type: file components

  anchore/grype#3824 · Filter by author digital-pickles opened on Oct 20, 2026
  5

• fix(version): Arch Linux (pacman) release candidates sort newer than the release

  anchore/grype#3819 · Filter by author 7-Bala opened on Oct 20, 2026
  1

• Direct upstream CPython CPE matches Bitnami-specific advisory ranges on fixed 3.15.0

  anchore/grype#3818 · Filter by author mabneyEAT opened on Oct 20, 2026

• CVE-2025-15367 matches DHI Python 3.14.8-r0 with the POP3 fix

  anchore/grype#3810 · Filter by author brspoon opened on Oct 18, 2026

• apk matcher: X.0_rcN compares as newer than X.0, which can hide a vulnerability

  anchore/grype#3800 · Filter by author aledbf opened on Oct 13, 2026
  1

• No vulnerability matches for Fedora-derived images that set their own VERSION_CODENAME (bluefin)

  anchore/grype#3799 · Filter by author tomersein opened on Oct 13, 2026

• Hummingbird CVE-2026-95619: versionless gcc source match persists alongside fixed range

  anchore/grype#3792 · Filter by author vladislavbabarikov opened on Oct 12, 2026

• False positive: GHSA-537c-gmf6-5ccf — OS-backported RPM cryptography flagged against upstream version

  bug
  anchore/grype#3769 · Filter by author sekveaja opened on Oct 2, 2026

• Grype does not match a CPE-backed CVE to a PyPI PURL

  bugfalse-positive
  anchore/grype#3757 · Filter by author sonawanesarvesh opened on Oct 1, 2026
  7

  

• Add fail-on-epss or fail-on-risk next to fail-on-severity

  enhancement
  anchore/grype#3754 · Filter by author Akashic101 opened on Oct 1, 2026
  3

• False positives on Oracle Linux: _fips ELSA fixes (epoch 10) matched against standard non-FIPS packages

  bug
  anchore/grype#3750 · Filter by author jmfgd opened on Sep 29, 2026
  4

• Proposal: show SRAC safety context beside vulnerability findings

  anchore/grype#3748 · Filter by author devashridatta-dotcom opened on Sep 27, 2026