Issues

• False positive: GHSA-537c-gmf6-5ccf — OS-backported RPM cryptography flagged against upstream version

  bug
  anchore/grype#3769 · Filter by author sekveaja opened on Oct 2, 2026

• False Positive: 4 CVES — OS-backported RPM python3-cryptography-3.3.2-150400.26.1 flagged against upstream PyPI versions

  bug
  anchore/grype#3768 · Filter by author sekveaja opened on Oct 2, 2026

• grype 0.119.0 allocates without bound on a CycloneDX machine-learning-model component with no purl and no CPE

  anchore/grype#3767 · Filter by author sanchitmonga22 opened on Oct 2, 2026

• Table presenter appends a spurious ", ..." to the FIX column when all fix versions are already shown

  anchore/grype#3760 · Filter by author yunaremaia opened on Oct 2, 2026

• Grype does not match a CPE-backed CVE to a PyPI PURL

  bugfalse-positive
  anchore/grype#3757 · Filter by author sonawanesarvesh opened on Oct 1, 2026
  2

• Add fail-on-epss or fail-on-risk next to fail-on-severity

  enhancement
  anchore/grype#3754 · Filter by author Akashic101 opened on Oct 1, 2026
  3

• False positives on Oracle Linux: _fips ELSA fixes (epoch 10) matched against standard non-FIPS packages

  bug
  anchore/grype#3750 · Filter by author jmfgd opened on Sep 29, 2026
  3

• Proposal: show SRAC safety context beside vulnerability findings

  anchore/grype#3748 · Filter by author devashridatta-dotcom opened on Sep 27, 2026

• Grype does not list all vulnerabilities for a package and version

  bugfalse-positive
  anchore/grype#3742 · Filter by author jkugler opened on Sep 25, 2026
  1

• Scorecards workflow fails weekly on main (environment policy) and on tag pushes (publish rejection)

  anchore/grype#3737 · Filter by author simpleqt opened on Sep 24, 2026

• False positive: CVE-2026-2913 matches fixed libvips 8.18.6 through NVD CPE range

  anchore/grype#3733 · Filter by author liorium opened on Sep 24, 2026
  1

• Missing Maven/PURL association for CVE-2026-59270 in spring-security-core

  bugfalse-positive
  anchore/grype#3731 · Filter by author ojacquemart opened on Sep 23, 2026

• Transitive dependency on Vulnerable github.com/docker/docker package

  bug
  anchore/grype#3724 · Filter by author rthiyatlsn opened on Sep 21, 2026
  1

• False positives on CPython 3.12.14: missing 3.12 backport for CVE-2026-3644, CVE-2026-4224, CVE-2026-7210

  anchore/grype#3694 · Filter by author WSG23 opened on Sep 8, 2026
  3

• False positive: GHSA-537c-gmf6-5ccf matched against RPM-installed python3-cryptography

  bugfalse-positive
  anchore/grype#3672 · Filter by author etarast opened on Aug 25, 2026
  1

  

• Grype misses critical CVEs for vendored libraries owned by unrelated RPMs

  bug
  anchore/grype#3670 · Filter by author sekveaja opened on Aug 21, 2026
  1

• Grype is reporting vulnerability CVE-2026-43500 Ubuntu Kernel Dirty Frag in a fixed kernel

  bug
  anchore/grype#3660 · Filter by author nba1992 opened on Aug 20, 2026
  1

• JUnit XML template

  enhancement
  anchore/grype#3626 · Filter by author atombrella opened on Jul 31, 2026

• On HTML report Vulnerability DB info takes too much place

  enhancementgood-first-issue
  anchore/grype#3607 · Filter by author ViacheslavKudinov opened on Jul 28, 2026
  2

• Grype should find and analyze SBOM attestations

  enhancement
  anchore/grype#3604 · Filter by author brawer opened on Jul 27, 2026
  2

• Unfixable vulnerabilities with ownership overlap in Ubuntu and distro managed Go binaries are reported as fixable

  bug
  anchore/grype#3595 · Filter by author BurningNetel opened on Jul 23, 2026
  2

• Vulnerability Scanning Fails for Maven Packages with CPEs in CycloneDX SBOM JSON

  enhancementfalse-positiveneeds-discussion
  anchore/grype#3594 · Filter by author pganaus opened on Jul 23, 2026
  2

• Alpine curl version mismatch in findings: Grype reports 8.5.8 while container has 8.21.0-r0 installed

  bugneeds-investigation
  anchore/grype#3571 · Filter by author jackthomasatl opened on Jul 14, 2026
  17

• Support for bun as JavaScript package ecosystem

  enhancement
  anchore/grype#3559 · Filter by author pitmullerIngka opened on Jul 7, 2026
  1

• False positive CVE-2025-35036 — hibernate-validator 6.0.23.SP1-redhat-00001 flagged but Red Hat backported the fix

  bug
  anchore/grype#3530 · Filter by author etarast opened on Jun 24, 2026
  1