# Known vulnerabilities not in Chainguard / Wolfi tracker? **URL:** \ **Category:** General\ **Created:** [December 21, 2024, 12:53pm UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286 "2024-12-21T12:53:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ishan](https://avatars.discourse-cdn.com/v4/letter/i/3da27b/32.png) [@ishan](https://anchorecommunity.discourse.group/u/ishan)\ **Post date:** [December 21, 2024, 12:53pm UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286/1 "2024-12-21T12:53:56Z")
Looking at the structure of [https://packages.wolfi.dev/os/security.json](https://packages.wolfi.dev/os/security.json) or chainguard security.json it seems that CVEs are only published for versions where there is a fix available. Example: [Chainguard Images - Advisories - CVE-2023-29406](https://images.chainguard.dev/security/CVE-2023-29406) shows that `go-1.21` package is vulnerable. but the security.json consumed by grype doesn’t reflect this. Is my understanding correct that grype won’t reflect these CVEs? This also holds true for when status is one of `Under investigation`, `Pending upstream fix` or `Fix not planned` as seen on chainguard advisories. ---
**Author:** ![ishan](https://avatars.discourse-cdn.com/v4/letter/i/3da27b/32.png) [@ishan](https://anchorecommunity.discourse.group/u/ishan)\ **Post date:** [January 17, 2025, 7:12am UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286/2 "2025-01-17T07:12:46Z")
@willmurphy @kzantow ? ---
**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\ **Post date:** [January 17, 2025, 3:05pm UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286/3 "2025-01-17T15:05:28Z")
Hi @ishan! Great question! For distros that use APK packages (Alpine, Wolfi, Chainguard), we search NVD’s CPE data for vulnerabilities, and then use the secdb data to rule out vulnerabilities that have been fixed. You can see that code here: [grype/grype/db/v5/matcher/apk/matcher.go at 66197338303a17cf6ba80d71a2c1d952e06ec68d · anchore/grype · GitHub](https://github.com/anchore/grype/blob/66197338303a17cf6ba80d71a2c1d952e06ec68d/grype/db/v5/matcher/apk/matcher.go#L169) Additionally, for package types that are covered by GitHub Security Advisories (for example, if the APK package includes a Ruby gem or Python package), Grype will search GitHub security advisory data for vulnerabilities about those packages. Does that answer your question? ---
**Author:** ![ishan](https://avatars.discourse-cdn.com/v4/letter/i/3da27b/32.png) [@ishan](https://anchorecommunity.discourse.group/u/ishan)\ **Post date:** [February 6, 2025, 7:01am UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286/4 "2025-02-06T07:01:02Z")
Yes for the most part, just one more followup question how does CPE based matching work for custom chainguard / wolfi packages? Like go-1.21 is a custom wolfi package, how does grype know the CPE to match for it? ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [February 6, 2025, 2:11pm UTC](https://anchorecommunity.discourse.group/t/known-vulnerabilities-not-in-chainguard-wolfi-tracker/286/5 "2025-02-06T14:11:43Z")
If you run [Syft](https://github.com/anchore/syft) on the image containing the artifact in question (with JSON output format, e.g. `syft -o json`), it will show you the CPEs that it has generated or otherwise found for the package. These are the CPEs that Grype will use to match against.