vex-hub pulls together more of what each vendor says about a CVE, so Trivy's --vex flag can suppress the ones the vendor already ruled out.
CVE-2025-2487 on RHEL 9.6 EUScurl -X POST https://vex.getreel.dev/v1/statements \
-H "Content-Type: application/json" \
-d '{
"cves": ["CVE-2026-2100"],
"products": ["pkg:rpm/redhat/p11-kit"]
}' > vex.jsontrivy image --vex vex.json --show-suppressed \
registry.access.redhat.com/ubi9/ubi:latestRe-scan a UBI9 image with --vex vex.json --show-suppressed and the CVE drops out of your findings into the suppressed table, with the vendor's reasoning attached.
Suppressed Vulnerabilities (Total: 1)
=====================================
┌────────────┬───────────────┬──────────┬──────────────┬─────────────────────────────┬──────────┐
│ Library │ Vulnerability │ Severity │ Status │ Statement │ Source │
├────────────┼───────────────┼──────────┼──────────────┼─────────────────────────────┼──────────┤
│ p11-kit │ CVE-2026-2100 │ MEDIUM │ not_affected │ vulnerable_code_not_present │ vex.json │
└────────────┴───────────────┴──────────┴──────────────┴─────────────────────────────┴──────────┘The flow above works the same on any distro. Trivy names the package when it scans an image, and vex-hub answers for whichever vendor it lands on.
| Vendor | Coverage | Feed |
|---|---|---|
| Red Hat | RHEL plus EUS, AUS, and E4S extended-support streams | CSAF · OVAL |
| SUSE | SUSE Linux Enterprise and openSUSE | CSAF |
| Ubuntu | 20.04, 22.04, 24.04 LTS plus Ubuntu Pro ESM tracks | OpenVEX · OVAL |
| Debian | 11 (bullseye), 12 (bookworm), 13 (trixie) | OVAL |
For example, swap pkg:rpm/redhat/p11-kit for pkg:deb/debian/openssl?distro=debian-12 when scanning a Debian image.