Stop flagging CVEs the vendor already resolved

Two commands

curl -X POST https://vex.getreel.dev/v1/resolve \
  -H "Content-Type: application/json" \
  -d '{
    "cves": ["CVE-2026-2100"],
    "products": ["pkg:rpm/redhat/p11-kit"],
    "format": "openvex"
  }' > vex.json

trivy image --vex vex.json --show-suppressed \
  registry.access.redhat.com/ubi9/ubi:latest

Docs →

Real suppression on UBI9

1. 01

   Scan without VEX — 335 findings

   trivy image --format json \
     registry.access.redhat.com/ubi9/ubi:latest > scan.json

2. 02

   Fetch VEX from vex-hub

   curl -X POST https://vex.getreel.dev/v1/resolve \
     -H "Content-Type: application/json" \
     -d '{"cves":["CVE-2026-2100"],
          "products":["pkg:rpm/redhat/p11-kit"],
          "format":"openvex"}' > vex.json

3. 03

   Re-scan with --vex — finding suppressed

   trivy image --vex vex.json --show-suppressed \
     registry.access.redhat.com/ubi9/ubi:latest

   Suppressed Vulnerabilities (Total: 1)
   =====================================
   ┌────────────┬───────────────┬──────────┬──────────────┬─────────────────────────────┬──────────┐
   │  Library   │ Vulnerability │ Severity │    Status    │          Statement          │  Source  │
   ├────────────┼───────────────┼──────────┼──────────────┼─────────────────────────────┼──────────┤
   │ p11-kit    │ CVE-2026-2100 │ MEDIUM   │ not_affected │ vulnerable_code_not_present │ vex.json │
   └────────────┴───────────────┴──────────┴──────────────┴─────────────────────────────┴──────────┘