Repository: stackrox/stackrox
Pull request #15468: ROX-29074: include advisory data and CVSS in roxctl image scan output
Author: login: RTann
Labels: name: area/roxctl
Created: 2025-05-28T16:16:28Z | Merged: 2025-05-30T21:14:16Z

### Description

The [Red Hat Vulnerability Scanner Certification](https://redhat-connect.gitbook.io/partner-guide-red-hat-vulnerability-scanner-cert) program requires partners to submit responses in CSV format with [at least the following fields](https://redhat-connect.gitbook.io/partner-guide-red-hat-vulnerability-scanner-cert/requirements#id-1.2-vendor-certification-submission-report-file-format-and-structure):

* CVE ID
* Package
* Package version
* Red Hat Severity
* Red Hat CVSS
* Link / resource / fix information (ie. RHSA)

`roxctl image scan --output csv` already gave us everything minus the advisory information we desire, so this PR adds it. This way, we can submit results by just simply running something like:

`roxctl image scan -i <image> --output csv -f > results.csv`

Note: a requirement is to not modify the output. It must be something which customers may generate on their own without manual/extra intervention. Updating the `--output csv` output is the easiest way for us to generate these results.

### User-facing documentation

- [x] [CHANGELOG.md](https://github.com/stackrox/stackrox/blob/master/CHANGELOG.md) is updated
- [x] documentation PR is not needed

### Testing and quality

- [x] the change is production ready: the change is [GA](https://github.com/stackrox/stackrox/blob/master/PR_GA.md), or otherwise the functionality is gated by a [feature flag](https://github.com/stackrox/stackrox/blob/master/pkg/features/README.md)
- [x] CI results are [inspected](https://docs.google.com/document/d/1d5ga073jkv4CO1kAJqp8MPGpC6E1bwyrCGZ7S5wKg3w/edit?tab=t.0#heading=h.w4ercgtcg0xp)

#### Automated testing

- [x] modified existing tests

#### How I validated my change

CI + manual testing with a cluster running StackRox version `4.8.x-834-g68f35eef12` with Scanner V4 enabled.

I generated my own `roxctl` based on this branch via:

`make cli_darwin-arm64 cli-install`

I then ran:

```
roxctl -e <Central endpoint> --insecure-skip-tls-verify image scan -i registry.redhat.io/rhel9/python-312@sha256:a4b270f826f5ae08eefada3a73c989fd2cfb712df9d9b86cdce53ee201189a8c --output <format> -f
```

Outputs:

[python-312.csv](https://github.com/user-attachments/files/20509038/python-312.csv)
[python-312.json](https://github.com/user-attachments/files/20509040/python-312.json)
[python-312.txt](https://github.com/user-attachments/files/20509042/python-312.txt)
[python-312-sarif.txt](https://github.com/user-attachments/files/20509045/python-312-sarif.txt)



Diff:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2f1aacf50970..913a36a6b9057 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -61,6 +61,10 @@ Scanner V4 claims the images contain vulnerabilities which the official Red Hat
   The above values will need to be updated to match your release name (i.e. "stackrox-central-services") or namespace (i.e. "stackrox") in case you had used different ones.
 - ROX-22597: The S3 backup integration is migrated to the AWS go SDK v2. GCS buckets are not supported anymore by the S3 integration type, as announced in 4.5.0, users should use dedicated GCS integrations for these.
 - The scoping of Google image integrations by project is now optional.
+- ROX-29074: The default output of `roxctl image scan` when using the `--output` flag will now include three new fields, by default: CVSS, Advisory, and Advisory Link (the exact names depend on the specific output format).
+  - CVSS represents the CVSS score of the vulnerability.
+  - The Advisory and Advisory Link fields represent the advisory related to the vulnerability, if it exists and is tracked by StackRox.
+    - A typical example is a CVE's associated RHSA (Red Hat Security Advisory), if the CVE is related to a Red Hat product.
 
 ## [4.7.0]
 
diff --git a/roxctl/common/printer/tabularprinter_factory.go b/roxctl/common/printer/tabularprinter_factory.go
index b091a176e8eb8..e6ada41d2baf9 100644
--- a/roxctl/common/printer/tabularprinter_factory.go
+++ b/roxctl/common/printer/tabularprinter_factory.go
@@ -12,15 +12,18 @@ import (
 
 var (
 	// Default headers to use when printing tabular output.
-	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "LINK", "FIXED_VERSION"}
+	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "CVSS", "LINK", "FIXED_VERSION", "ADVISORY", "ADVISORY_LINK"}
 
 	imageScanHeaderToJSONPathMap = map[string]string{
 		"COMPONENT":     "result.vulnerabilities.#.componentName",
 		"VERSION":       "result.vulnerabilities.#.componentVersion",
 		"CVE":           "result.vulnerabilities.#.cveId",
 		"SEVERITY":      "result.vulnerabilities.#.cveSeverity",
+		"CVSS":          "result.vulnerabilities.#.cveCVSS",
 		"LINK":          "result.vulnerabilities.#.cveInfo",
 		"FIXED_VERSION": "result.vulnerabilities.#.componentFixedVersion",
+		"ADVISORY":      "result.vulnerabilities.#.advisoryId",
+		"ADVISORY_LINK": "result.vulnerabilities.#.advisoryInfo",
 	}
 
 	// Default JSON path expression representing a row within tabular output, based on the mapping above.
@@ -28,8 +31,11 @@ var (
 		"result.vulnerabilities.#.componentVersion," +
 		"result.vulnerabilities.#.cveId," +
 		"result.vulnerabilities.#.cveSeverity," +
+		"result.vulnerabilities.#.cveCVSS," +
 		"result.vulnerabilities.#.cveInfo," +
-		"result.vulnerabilities.#.componentFixedVersion}"
+		"result.vulnerabilities.#.componentFixedVersion," +
+		"result.vulnerabilities.#.advisoryId," +
+		"result.vulnerabilities.#.advisoryInfo}"
 )
 
 // TabularPrinterFactory holds all configuration options of tabular printers, specifically CSVPrinter and TablePrinter
diff --git a/roxctl/common/printer/tabularprinter_factory_test.go b/roxctl/common/printer/tabularprinter_factory_test.go
index 3fd0922b7aba4..5c65ef76de7f2 100644
--- a/roxctl/common/printer/tabularprinter_factory_test.go
+++ b/roxctl/common/printer/tabularprinter_factory_test.go
@@ -156,8 +156,11 @@ func TestTabularPrinterFactory_CustomHeaderPropagation(t *testing.T) {
 				"result.vulnerabilities.#.componentVersion," +
 				"result.vulnerabilities.#.cveId," +
 				"result.vulnerabilities.#.cveSeverity," +
+				"result.vulnerabilities.#.cveCVSS," +
 				"result.vulnerabilities.#.cveInfo," +
-				"result.vulnerabilities.#.componentFixedVersion}",
+				"result.vulnerabilities.#.componentFixedVersion," +
+				"result.vulnerabilities.#.advisoryId," +
+				"result.vulnerabilities.#.advisoryInfo}",
 		},
 		"Reversed": {
 			t: &TabularPrinterFactory{
@@ -165,8 +168,11 @@ func TestTabularPrinterFactory_CustomHeaderPropagation(t *testing.T) {
 				RowJSONPathExpression: defaultImageScanJSONPathExpression,
 			},
 			expectedJSONPathExpression: "{" +
+				"result.vulnerabilities.#.advisoryInfo," +
+				"result.vulnerabilities.#.advisoryId," +
 				"result.vulnerabilities.#.componentFixedVersion," +
 				"result.vulnerabilities.#.cveInfo," +
+				"result.vulnerabilities.#.cveCVSS," +
 				"result.vulnerabilities.#.cveSeverity," +
 				"result.vulnerabilities.#.cveId," +
 				"result.vulnerabilities.#.componentVersion," +
diff --git a/roxctl/image/scan/cve.go b/roxctl/image/scan/cve.go
index bc9077a03e0d8..b450065effaa8 100644
--- a/roxctl/image/scan/cve.go
+++ b/roxctl/image/scan/cve.go
@@ -1,9 +1,9 @@
 package scan
 
 import (
+	"cmp"
 	"encoding/json"
 	"slices"
-	"sort"
 	"strings"
 
 	"github.com/stackrox/rox/generated/storage"
@@ -67,7 +67,10 @@ type cveJSONStructure struct {
 type cveVulnerabilityJSON struct {
 	CveID                 string      `json:"cveId"`
 	CveSeverity           cveSeverity `json:"cveSeverity"`
+	CveCVSS               float32     `json:"cveCVSS"`
 	CveInfo               string      `json:"cveInfo"`
+	AdvisoryID            string      `json:"advisoryId"`
+	AdvisoryInfo          string      `json:"advisoryInfo"`
 	ComponentName         string      `json:"componentName"`
 	ComponentVersion      string      `json:"componentVersion"`
 	ComponentFixedVersion string      `json:"componentFixedVersion"`
@@ -92,7 +95,7 @@ func newCVESummaryForPrinting(scanResults *storage.ImageScan, severities []strin
 		}
 	}
 
-	sortVulnerabilitiesBySeverityGroupedByComponentName(vulnerabilitiesJSON)
+	sortVulnerabilityJSONs(vulnerabilitiesJSON)
 
 	return &cveJSONResult{
 		Result: cveJSONStructure{
@@ -105,8 +108,8 @@ func newCVESummaryForPrinting(scanResults *storage.ImageScan, severities []strin
 func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp *storage.EmbeddedImageScanComponent,
 	numOfVulnsBySeverity map[string]int, uniqueCVEs set.StringSet,
 	severitiesToInclude []cveSeverity) []cveVulnerabilityJSON {
-	// sort vulnerabilities by severity
-	vulnerabilities = sortVulnerabilitiesForSeverity(vulnerabilities)
+	// sort vulnerabilities by severity and CVSS score
+	sortVulnerabilities(vulnerabilities)
 
 	vulnerabilitiesJSON := make([]cveVulnerabilityJSON, 0, len(vulnerabilities))
 	for _, vulnerability := range vulnerabilities {
@@ -118,7 +121,10 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 		vulnJSON := cveVulnerabilityJSON{
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
+			CveCVSS:               vulnerability.GetCvss(),
 			CveInfo:               vulnerability.GetLink(),
+			AdvisoryID:            vulnerability.GetAdvisory().GetName(),
+			AdvisoryInfo:          vulnerability.GetAdvisory().GetLink(),
 			ComponentName:         comp.GetName(),
 			ComponentVersion:      comp.GetVersion(),
 			ComponentFixedVersion: vulnerability.GetFixedBy(),
@@ -135,24 +141,39 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 	return vulnerabilitiesJSON
 }
 
-func sortVulnerabilitiesBySeverityGroupedByComponentName(vulnerabilitiesJSON []cveVulnerabilityJSON) {
+// sortVulnerabilityJSONs sorts the given slice of vulnerabilityJSON structs in decreasing order by the component's maximum severity.
+// If two severities match, then they are sorted in increasing order by component name.
+// If the names also match, then they are sorted in decreasing order by severity.
+// If the severities also match, then they are sorted in decreasing order by CVSS score.
+func sortVulnerabilityJSONs(vulns []cveVulnerabilityJSON) {
 	componentMaxSeverity := map[string]cveSeverity{}
-	for _, v := range vulnerabilitiesJSON {
+	for _, v := range vulns {
 		componentMaxSeverity[v.ComponentName] = max(v.CveSeverity, componentMaxSeverity[v.ComponentName])
 	}
-	sort.SliceStable(vulnerabilitiesJSON, func(i, j int) bool {
-		a := vulnerabilitiesJSON[i]
-		b := vulnerabilitiesJSON[j]
-		if componentMaxSeverity[a.ComponentName] == componentMaxSeverity[b.ComponentName] {
-			return a.ComponentName < b.ComponentName
+	slices.SortStableFunc(vulns, func(a, b cveVulnerabilityJSON) int {
+		sevAMax, sevBMax := componentMaxSeverity[a.ComponentName], componentMaxSeverity[b.ComponentName]
+		if c := cmp.Compare(sevBMax, sevAMax); c != 0 {
+			return c
 		}
-		return componentMaxSeverity[a.ComponentName] > componentMaxSeverity[b.ComponentName]
+		if c := cmp.Compare(a.ComponentName, b.ComponentName); c != 0 {
+			return c
+		}
+		if c := cmp.Compare(b.CveSeverity, a.CveSeverity); c != 0 {
+			return c
+		}
+		return cmp.Compare(b.CveCVSS, a.CveCVSS)
 	})
 }
 
-func sortVulnerabilitiesForSeverity(vulns []*storage.EmbeddedVulnerability) []*storage.EmbeddedVulnerability {
-	sort.SliceStable(vulns, func(p, q int) bool { return vulns[p].GetSeverity() > vulns[q].GetSeverity() })
-	return vulns
+// sortVulnerabilities sorts the given slice of vulnerabilities in decreasing order by severity.
+// If two severities match, then they are sorted in decreasing order by CVSS score.
+func sortVulnerabilities(vulns []*storage.EmbeddedVulnerability) {
+	slices.SortStableFunc(vulns, func(a, b *storage.EmbeddedVulnerability) int {
+		if c := cmp.Compare(b.GetSeverity(), a.GetSeverity()); c != 0 {
+			return c
+		}
+		return cmp.Compare(b.GetCvss(), a.GetCvss())
+	})
 }
 
 func stripVulnerabilitySevEnum(severityName string) string {
diff --git a/roxctl/image/scan/cve_test.go b/roxctl/image/scan/cve_test.go
index 2fab953901b92..2f466e48bd7c5 100644
--- a/roxctl/image/scan/cve_test.go
+++ b/roxctl/image/scan/cve_test.go
@@ -14,6 +14,7 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			Summary:    "CVE Test 2",
 			Link:       "cve-link-2",
 			Severity:   storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
+			Cvss:       1.2,
 			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.0"},
 		},
 		{
@@ -21,6 +22,7 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			Summary:    "CVE Test 1",
 			Link:       "cve-link-1",
 			Severity:   storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+			Cvss:       10.0,
 			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.2"},
 		},
 		{
@@ -28,6 +30,7 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			Summary:    "CVE Test 3",
 			Link:       "cve-link-3",
 			Severity:   storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+			Cvss:       7.5,
 			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.3"},
 		},
 		{
@@ -37,26 +40,55 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			Severity:   storage.VulnerabilitySeverity_MODERATE_VULNERABILITY_SEVERITY,
 			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.4"},
 		},
+		{
+			Cve:        "CVE-TEST-5",
+			Summary:    "CVE Test 5",
+			Link:       "cve-link-5",
+			Severity:   storage.VulnerabilitySeverity_IMPORTANT_VULNERABILITY_SEVERITY,
+			Cvss:       8.1,
+			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.5"},
+			Advisory: &storage.Advisory{
+				Name: "ADVISORY-TEST-5",
+				Link: "advisory-link-5",
+			},
+		},
+		{
+			Cve:        "CVE-TEST-6",
+			Summary:    "CVE Test 6",
+			Link:       "cve-link-6",
+			Severity:   storage.VulnerabilitySeverity_LOW_VULNERABILITY_SEVERITY,
+			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.6"},
+			Advisory: &storage.Advisory{
+				Name: "ADVISORY-TEST-6",
+				Link: "advisory-link-6",
+			},
+		},
 	}
 
 	// Expected vulns and components without filtering.
 	expectedVulnsComponentA := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.2"},
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", CveCVSS: 10.0, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.2"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.4"},
-		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", CveCVSS: 1.2, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-6", CveSeverity: lowCVESeverity, CveInfo: "cve-link-6", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.6", AdvisoryID: "ADVISORY-TEST-6", AdvisoryInfo: "advisory-link-6"},
 	}
 	expectedVulnsComponentB := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.2"},
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", CveCVSS: 10.0, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.2"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.4"},
-		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", CveCVSS: 1.2, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-6", CveSeverity: lowCVESeverity, CveInfo: "cve-link-6", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.6", AdvisoryID: "ADVISORY-TEST-6", AdvisoryInfo: "advisory-link-6"},
 	}
 	expectedVulnsComponentC := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.2"},
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-1", CveSeverity: criticalCVESeverity, CveInfo: "cve-link-1", CveCVSS: 10.0, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.2"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.4"},
-		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-2", CveSeverity: lowCVESeverity, CveInfo: "cve-link-2", CveCVSS: 1.2, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.0"},
+		{CveID: "CVE-TEST-6", CveSeverity: lowCVESeverity, CveInfo: "cve-link-6", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.6", AdvisoryID: "ADVISORY-TEST-6", AdvisoryInfo: "advisory-link-6"},
 	}
 	expectedVulnsComponentD := []cveVulnerabilityJSON{
 		{
@@ -66,15 +98,18 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 
 	// Expected vulns and components when filtered.
 	expectedVulnsComponentAFiltered := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentA", ComponentVersion: "1.0.0-1", ComponentFixedVersion: "1.4"},
 	}
 	expectedVulnsComponentBFiltered := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentB", ComponentVersion: "1.0.0-2", ComponentFixedVersion: "1.4"},
 	}
 	expectedVulnsComponentCFiltered := []cveVulnerabilityJSON{
-		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.3"},
+		{CveID: "CVE-TEST-5", CveSeverity: importantCVESeverity, CveInfo: "cve-link-5", CveCVSS: 8.1, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.5", AdvisoryID: "ADVISORY-TEST-5", AdvisoryInfo: "advisory-link-5"},
+		{CveID: "CVE-TEST-3", CveSeverity: importantCVESeverity, CveInfo: "cve-link-3", CveCVSS: 7.5, ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.3"},
 		{CveID: "CVE-TEST-4", CveSeverity: moderateCVESeverity, CveInfo: "cve-link-4", ComponentName: "componentC", ComponentVersion: "1.0.0-3", ComponentFixedVersion: "1.4"},
 	}
 
@@ -215,11 +250,11 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			expectedOutput: &cveJSONResult{
 				Result: cveJSONStructure{
 					Summary: map[string]int{
-						"TOTAL-VULNERABILITIES": 5,
+						"TOTAL-VULNERABILITIES": 7,
 						"TOTAL-COMPONENTS":      4,
-						"LOW":                   1,
+						"LOW":                   2,
 						"MODERATE":              1,
-						"IMPORTANT":             1,
+						"IMPORTANT":             2,
 						"CRITICAL":              2,
 					},
 					Vulnerabilities: append(expectedVulnsComponentA, append(expectedVulnsComponentB, append(expectedVulnsComponentC, expectedVulnsComponentD...)...)...),
@@ -267,11 +302,11 @@ func TestNewCVESummaryForPrinting(t *testing.T) {
 			expectedOutput: &cveJSONResult{
 				Result: cveJSONStructure{
 					Summary: map[string]int{
-						"TOTAL-VULNERABILITIES": 2,
+						"TOTAL-VULNERABILITIES": 3,
 						"TOTAL-COMPONENTS":      3,
 						"LOW":                   0,
 						"MODERATE":              1,
-						"IMPORTANT":             1,
+						"IMPORTANT":             2,
 						"CRITICAL":              0,
 					},
 					Vulnerabilities: append(expectedVulnsComponentAFiltered, append(expectedVulnsComponentBFiltered, expectedVulnsComponentCFiltered...)...),
diff --git a/roxctl/image/scan/scan.go b/roxctl/image/scan/scan.go
index 71503e784a341..254dc28c72212 100644
--- a/roxctl/image/scan/scan.go
+++ b/roxctl/image/scan/scan.go
@@ -61,6 +61,10 @@ var (
 				Key:        "Severity",
 				Expression: "result.vulnerabilities.#.cveSeverity",
 			},
+			gjson.Expression{
+				Key:        "CVSS",
+				Expression: "result.vulnerabilities.#.cveCvss",
+			},
 			gjson.Expression{
 				Key:        "Component",
 				Expression: "result.vulnerabilities.#.componentName",
@@ -73,6 +77,14 @@ var (
 				Key:        "Fixed Version",
 				Expression: "result.vulnerabilities.#.componentFixedVersion",
 			},
+			gjson.Expression{
+				Key:        "Advisory",
+				Expression: "result.vulnerabilities.#.advisoryId",
+			},
+			gjson.Expression{
+				Key:        "Advisory Link",
+				Expression: "result.vulnerabilities.#.advisoryInfo",
+			},
 		),
 		printers.SarifSeverityJSONPathExpressionKey: "result.vulnerabilities.#.cveSeverity",
 		printers.SarifHelpLinkJSONPathExpressionKey: "result.vulnerabilities.#.cveInfo",
diff --git a/roxctl/image/scan/scan_test.go b/roxctl/image/scan/scan_test.go
index a3addea0d97d3..fc884c84a9eb2 100644
--- a/roxctl/image/scan/scan_test.go
+++ b/roxctl/image/scan/scan_test.go
@@ -130,6 +130,10 @@ var (
 			Link:       "<some-link-to-nvd>",
 			SetFixedBy: &storage.EmbeddedVulnerability_FixedBy{FixedBy: "1.3"},
 			Severity:   storage.VulnerabilitySeverity_CRITICAL_VULNERABILITY_SEVERITY,
+			Advisory: &storage.Advisory{
+				Name: "ADVISORY-789-CRIT",
+				Link: "<some-link-to-somewhere>",
+			},
 		},
 	}
 	testComponents = []*storage.EmbeddedImageScanComponent{
diff --git a/roxctl/image/scan/testdata/color_empty.csv b/roxctl/image/scan/testdata/color_empty.csv
index 066a280f0e7c1..3669e43ed9355 100755
--- a/roxctl/image/scan/testdata/color_empty.csv
+++ b/roxctl/image/scan/testdata/color_empty.csv
@@ -1 +1 @@
-COMPONENT,VERSION,CVE,SEVERITY,LINK,FIXED_VERSION
+COMPONENT,VERSION,CVE,SEVERITY,CVSS,LINK,FIXED_VERSION,ADVISORY,ADVISORY_LINK
diff --git a/roxctl/image/scan/testdata/color_empty.txt b/roxctl/image/scan/testdata/color_empty.txt
index f5f59f506e661..f03ac76cab6ea 100755
--- a/roxctl/image/scan/testdata/color_empty.txt
+++ b/roxctl/image/scan/testdata/color_empty.txt
@@ -1,6 +1,6 @@
 Scan results for image: nginx:test
 (TOTAL-COMPONENTS: 0, TOTAL-VULNERABILITIES: 0, [34;2mLOW[0;22m: 0, MODERATE: 0, [31mIMPORTANT[0m: 0, [31;1mCRITICAL[0;22m: 0)
 
-+-----------+---------+-----+----------+------+---------------+
-| COMPONENT | VERSION | CVE | SEVERITY | LINK | FIXED VERSION |
-+-----------+---------+-----+----------+------+---------------+
++-----------+---------+-----+----------+------+------+---------------+----------+---------------+
+| COMPONENT | VERSION | CVE | SEVERITY | CVSS | LINK | FIXED VERSION | ADVISORY | ADVISORY LINK |
++-----------+---------+-----+----------+------+------+---------------+----------+---------------+
diff --git a/roxctl/image/scan/testdata/color_testComponents.csv b/roxctl/image/scan/testdata/color_testComponents.csv
index dc2fcf00a82dc..319a124c995fa 100755
--- a/roxctl/image/scan/testdata/color_testComponents.csv
+++ b/roxctl/image/scan/testdata/color_testComponents.csv
@@ -1,18 +1,18 @@
-COMPONENT,VERSION,CVE,SEVERITY,LINK,FIXED_VERSION
-apt,1.0,CVE-789-CRIT,[31;1mCRITICAL[0;22m,<some-link-to-nvd>,1.3
-apt,1.0,CVE-123-[34;2mLOW[0;22m,[34;2mLOW[0;22m,<some-link-to-nvd>,1.1
-apt,1.0,CVE-789-[34;2mLOW[0;22m,[34;2mLOW[0;22m,<some-link-to-nvd>,1.3
-bash,4.2,CVE-123-CRIT,[31;1mCRITICAL[0;22m,<some-link-to-nvd>,1.1
-bash,4.2,CVE-456-CRIT,[31;1mCRITICAL[0;22m,<some-link-to-nvd>,1.2
-bash,4.2,CVE-789-CRIT,[31;1mCRITICAL[0;22m,<some-link-to-nvd>,1.3
-openssl,1.1.1k,CVE-789-CRIT,[31;1mCRITICAL[0;22m,<some-link-to-nvd>,1.3
-openssl,1.1.1k,CVE-123-IMP,[31mIMPORTANT[0m,<some-link-to-nvd>,1.1
-openssl,1.1.1k,CVE-123-MED,MODERATE,<some-link-to-nvd>,1.1
-openssl,1.1.1k,CVE-456-MED,MODERATE,<some-link-to-nvd>,1.2
-openssl,1.1.1k,CVE-123-[34;2mLOW[0;22m,[34;2mLOW[0;22m,<some-link-to-nvd>,1.1
-curl,7.0-rc1,CVE-123-IMP,[31mIMPORTANT[0m,<some-link-to-nvd>,1.1
-curl,7.0-rc1,CVE-456-IMP,[31mIMPORTANT[0m,<some-link-to-nvd>,1.2
-curl,7.0-rc1,CVE-789-IMP,[31mIMPORTANT[0m,<some-link-to-nvd>,1.3
-systemd,1.3-debu49,CVE-123-MED,MODERATE,<some-link-to-nvd>,1.1
-systemd,1.3-debu49,CVE-456-MED,MODERATE,<some-link-to-nvd>,1.2
-systemd,1.3-debu49,CVE-789-MED,MODERATE,<some-link-to-nvd>,1.3
+COMPONENT,VERSION,CVE,SEVERITY,CVSS,LINK,FIXED_VERSION,ADVISORY,ADVISORY_LINK
+apt,1.0,CVE-789-CRIT,[31;1mCRITICAL[0;22m,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+apt,1.0,CVE-789-[34;2mLOW[0;22m,[34;2mLOW[0;22m,2.5,<some-link-to-nvd>,1.3,-,-
+apt,1.0,CVE-123-[34;2mLOW[0;22m,[34;2mLOW[0;22m,2,<some-link-to-nvd>,1.1,-,-
+bash,4.2,CVE-789-CRIT,[31;1mCRITICAL[0;22m,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+bash,4.2,CVE-456-CRIT,[31;1mCRITICAL[0;22m,9,<some-link-to-nvd>,1.2,-,-
+bash,4.2,CVE-123-CRIT,[31;1mCRITICAL[0;22m,8.5,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-789-CRIT,[31;1mCRITICAL[0;22m,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+openssl,1.1.1k,CVE-123-IMP,[31mIMPORTANT[0m,7,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-456-MED,MODERATE,4.9,<some-link-to-nvd>,1.2,-,-
+openssl,1.1.1k,CVE-123-MED,MODERATE,4.5,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-123-[34;2mLOW[0;22m,[34;2mLOW[0;22m,2,<some-link-to-nvd>,1.1,-,-
+curl,7.0-rc1,CVE-123-IMP,[31mIMPORTANT[0m,7,<some-link-to-nvd>,1.1,-,-
+curl,7.0-rc1,CVE-789-IMP,[31mIMPORTANT[0m,7,<some-link-to-nvd>,1.3,-,-
+curl,7.0-rc1,CVE-456-IMP,[31mIMPORTANT[0m,6.8,<some-link-to-nvd>,1.2,-,-
+systemd,1.3-debu49,CVE-789-MED,MODERATE,5.2,<some-link-to-nvd>,1.3,-,-
+systemd,1.3-debu49,CVE-456-MED,MODERATE,4.9,<some-link-to-nvd>,1.2,-,-
+systemd,1.3-debu49,CVE-123-MED,MODERATE,4.5,<some-link-to-nvd>,1.1,-,-
diff --git a/roxctl/image/scan/testdata/color_testComponents.json b/roxctl/image/scan/testdata/color_testComponents.json
index 44a46ce818f00..995cdfb2d650b 100755
--- a/roxctl/image/scan/testdata/color_testComponents.json
+++ b/roxctl/image/scan/testdata/color_testComponents.json
@@ -12,55 +12,76 @@
       {
         "cveId": "CVE-789-CRIT",
         "cveSeverity": "[31;1mCRITICAL[0;22m",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "apt",
         "componentVersion": "1.0",
         "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-123-[34;2mLOW[0;22m",
+        "cveId": "CVE-789-[34;2mLOW[0;22m",
         "cveSeverity": "[34;2mLOW[0;22m",
+        "cveCVSS": 2.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "apt",
         "componentVersion": "1.0",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-789-[34;2mLOW[0;22m",
+        "cveId": "CVE-123-[34;2mLOW[0;22m",
         "cveSeverity": "[34;2mLOW[0;22m",
+        "cveCVSS": 2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "apt",
         "componentVersion": "1.0",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-123-CRIT",
+        "cveId": "CVE-789-CRIT",
         "cveSeverity": "[31;1mCRITICAL[0;22m",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "bash",
         "componentVersion": "4.2",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
         "cveId": "CVE-456-CRIT",
         "cveSeverity": "[31;1mCRITICAL[0;22m",
+        "cveCVSS": 9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "bash",
         "componentVersion": "4.2",
         "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-789-CRIT",
+        "cveId": "CVE-123-CRIT",
         "cveSeverity": "[31;1mCRITICAL[0;22m",
+        "cveCVSS": 8.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "bash",
         "componentVersion": "4.2",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       },
       {
         "cveId": "CVE-789-CRIT",
         "cveSeverity": "[31;1mCRITICAL[0;22m",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.3"
@@ -68,31 +89,43 @@
       {
         "cveId": "CVE-123-IMP",
         "cveSeverity": "[31mIMPORTANT[0m",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-123-MED",
+        "cveId": "CVE-456-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-456-MED",
+        "cveId": "CVE-123-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
-        "componentFixedVersion": "1.2"
+        "componentFixedVersion": "1.1"
       },
       {
         "cveId": "CVE-123-[34;2mLOW[0;22m",
         "cveSeverity": "[34;2mLOW[0;22m",
+        "cveCVSS": 2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.1"
@@ -100,50 +133,68 @@
       {
         "cveId": "CVE-123-IMP",
         "cveSeverity": "[31mIMPORTANT[0m",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
         "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-456-IMP",
+        "cveId": "CVE-789-IMP",
         "cveSeverity": "[31mIMPORTANT[0m",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
-        "componentFixedVersion": "1.2"
+        "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-789-IMP",
+        "cveId": "CVE-456-IMP",
         "cveSeverity": "[31mIMPORTANT[0m",
+        "cveCVSS": 6.8,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-123-MED",
+        "cveId": "CVE-789-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 5.2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
         "cveId": "CVE-456-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
         "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-789-MED",
+        "cveId": "CVE-123-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       }
     ]
   }
diff --git a/roxctl/image/scan/testdata/color_testComponents.txt b/roxctl/image/scan/testdata/color_testComponents.txt
index 0959d57cb1730..0fb31c3ce99ef 100755
--- a/roxctl/image/scan/testdata/color_testComponents.txt
+++ b/roxctl/image/scan/testdata/color_testComponents.txt
@@ -1,40 +1,40 @@
 Scan results for image: nginx:test
 (TOTAL-COMPONENTS: 5, TOTAL-VULNERABILITIES: 11, [34;2mLOW[0;22m: 2, MODERATE: 3, [31mIMPORTANT[0m: 3, [31;1mCRITICAL[0;22m: 3)
 
-+-----------+------------+--------------+-----------+--------------------+---------------+
-| COMPONENT |  VERSION   |     CVE      | SEVERITY  |        LINK        | FIXED VERSION |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|    apt    |    1.0     | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | <some-link-to-nvd> |      1.3      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|   bash    |    4.2     | CVE-123-CRIT | [31;1mCRITICAL[0;22m  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-CRIT | [31;1mCRITICAL[0;22m  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|  openssl  |   1.1.1k   | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | <some-link-to-nvd> |      1.3      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-IMP  | [31mIMPORTANT[0m | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-MED  | MODERATE  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-MED  | MODERATE  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    | <some-link-to-nvd> |      1.1      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|   curl    |  7.0-rc1   | CVE-123-IMP  | [31mIMPORTANT[0m | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-IMP  | [31mIMPORTANT[0m | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-IMP  | [31mIMPORTANT[0m | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|  systemd  | 1.3-debu49 | CVE-123-MED  | MODERATE  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-MED  | MODERATE  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-MED  | MODERATE  | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+| COMPONENT |  VERSION   |     CVE      | SEVERITY  | CVSS |        LINK        | FIXED VERSION |     ADVISORY      |      ADVISORY LINK       |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|    apt    |    1.0     | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-789-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    | 2.5  | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    |  2   | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|   bash    |    4.2     | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-CRIT | [31;1mCRITICAL[0;22m  |  9   | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-CRIT | [31;1mCRITICAL[0;22m  | 8.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|  openssl  |   1.1.1k   | CVE-789-CRIT | [31;1mCRITICAL[0;22m  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-IMP  | [31mIMPORTANT[0m |  7   | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-MED  | MODERATE  | 4.9  | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-MED  | MODERATE  | 4.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-[34;2mLOW[0;22m  |    [34;2mLOW[0;22m    |  2   | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|   curl    |  7.0-rc1   | CVE-123-IMP  | [31mIMPORTANT[0m |  7   | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-789-IMP  | [31mIMPORTANT[0m |  7   | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-IMP  | [31mIMPORTANT[0m | 6.8  | <some-link-to-nvd> |      1.2      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|  systemd  | 1.3-debu49 | CVE-789-MED  | MODERATE  | 5.2  | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-MED  | MODERATE  | 4.9  | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-MED  | MODERATE  | 4.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
diff --git a/roxctl/image/scan/testdata/empty.csv b/roxctl/image/scan/testdata/empty.csv
index 066a280f0e7c1..3669e43ed9355 100755
--- a/roxctl/image/scan/testdata/empty.csv
+++ b/roxctl/image/scan/testdata/empty.csv
@@ -1 +1 @@
-COMPONENT,VERSION,CVE,SEVERITY,LINK,FIXED_VERSION
+COMPONENT,VERSION,CVE,SEVERITY,CVSS,LINK,FIXED_VERSION,ADVISORY,ADVISORY_LINK
diff --git a/roxctl/image/scan/testdata/empty.txt b/roxctl/image/scan/testdata/empty.txt
index 7923166f67dec..700a13dbcad11 100755
--- a/roxctl/image/scan/testdata/empty.txt
+++ b/roxctl/image/scan/testdata/empty.txt
@@ -1,6 +1,6 @@
 Scan results for image: nginx:test
 (TOTAL-COMPONENTS: 0, TOTAL-VULNERABILITIES: 0, LOW: 0, MODERATE: 0, IMPORTANT: 0, CRITICAL: 0)
 
-+-----------+---------+-----+----------+------+---------------+
-| COMPONENT | VERSION | CVE | SEVERITY | LINK | FIXED VERSION |
-+-----------+---------+-----+----------+------+---------------+
++-----------+---------+-----+----------+------+------+---------------+----------+---------------+
+| COMPONENT | VERSION | CVE | SEVERITY | CVSS | LINK | FIXED VERSION | ADVISORY | ADVISORY LINK |
++-----------+---------+-----+----------+------+------+---------------+----------+---------------+
diff --git a/roxctl/image/scan/testdata/legacy_testComponents.json b/roxctl/image/scan/testdata/legacy_testComponents.json
index 1040d20b159ab..612320ce028fa 100644
--- a/roxctl/image/scan/testdata/legacy_testComponents.json
+++ b/roxctl/image/scan/testdata/legacy_testComponents.json
@@ -45,7 +45,11 @@
             "summary": "This is a crit CVE 3",
             "link": "\u003csome-link-to-nvd\u003e",
             "fixedBy": "1.3",
-            "severity": "CRITICAL_VULNERABILITY_SEVERITY"
+            "severity": "CRITICAL_VULNERABILITY_SEVERITY",
+            "advisory": {
+              "name": "ADVISORY-789-CRIT",
+              "link": "\u003csome-link-to-somewhere\u003e"
+            }
           }
         ],
         "layerIndex": 0,
@@ -141,7 +145,11 @@
             "summary": "This is a crit CVE 3",
             "link": "\u003csome-link-to-nvd\u003e",
             "fixedBy": "1.3",
-            "severity": "CRITICAL_VULNERABILITY_SEVERITY"
+            "severity": "CRITICAL_VULNERABILITY_SEVERITY",
+            "advisory": {
+              "name": "ADVISORY-789-CRIT",
+              "link": "\u003csome-link-to-somewhere\u003e"
+            }
           }
         ],
         "layerIndex": 2,
@@ -189,7 +197,11 @@
             "summary": "This is a crit CVE 3",
             "link": "\u003csome-link-to-nvd\u003e",
             "fixedBy": "1.3",
-            "severity": "CRITICAL_VULNERABILITY_SEVERITY"
+            "severity": "CRITICAL_VULNERABILITY_SEVERITY",
+            "advisory": {
+              "name": "ADVISORY-789-CRIT",
+              "link": "\u003csome-link-to-somewhere\u003e"
+            }
           }
         ],
         "layerIndex": 2
diff --git a/roxctl/image/scan/testdata/testComponents.csv b/roxctl/image/scan/testdata/testComponents.csv
index 67afdb7e946ef..36a7d34812895 100755
--- a/roxctl/image/scan/testdata/testComponents.csv
+++ b/roxctl/image/scan/testdata/testComponents.csv
@@ -1,18 +1,18 @@
-COMPONENT,VERSION,CVE,SEVERITY,LINK,FIXED_VERSION
-apt,1.0,CVE-789-CRIT,CRITICAL,<some-link-to-nvd>,1.3
-apt,1.0,CVE-123-LOW,LOW,<some-link-to-nvd>,1.1
-apt,1.0,CVE-789-LOW,LOW,<some-link-to-nvd>,1.3
-bash,4.2,CVE-123-CRIT,CRITICAL,<some-link-to-nvd>,1.1
-bash,4.2,CVE-456-CRIT,CRITICAL,<some-link-to-nvd>,1.2
-bash,4.2,CVE-789-CRIT,CRITICAL,<some-link-to-nvd>,1.3
-openssl,1.1.1k,CVE-789-CRIT,CRITICAL,<some-link-to-nvd>,1.3
-openssl,1.1.1k,CVE-123-IMP,IMPORTANT,<some-link-to-nvd>,1.1
-openssl,1.1.1k,CVE-123-MED,MODERATE,<some-link-to-nvd>,1.1
-openssl,1.1.1k,CVE-456-MED,MODERATE,<some-link-to-nvd>,1.2
-openssl,1.1.1k,CVE-123-LOW,LOW,<some-link-to-nvd>,1.1
-curl,7.0-rc1,CVE-123-IMP,IMPORTANT,<some-link-to-nvd>,1.1
-curl,7.0-rc1,CVE-456-IMP,IMPORTANT,<some-link-to-nvd>,1.2
-curl,7.0-rc1,CVE-789-IMP,IMPORTANT,<some-link-to-nvd>,1.3
-systemd,1.3-debu49,CVE-123-MED,MODERATE,<some-link-to-nvd>,1.1
-systemd,1.3-debu49,CVE-456-MED,MODERATE,<some-link-to-nvd>,1.2
-systemd,1.3-debu49,CVE-789-MED,MODERATE,<some-link-to-nvd>,1.3
+COMPONENT,VERSION,CVE,SEVERITY,CVSS,LINK,FIXED_VERSION,ADVISORY,ADVISORY_LINK
+apt,1.0,CVE-789-CRIT,CRITICAL,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+apt,1.0,CVE-789-LOW,LOW,2.5,<some-link-to-nvd>,1.3,-,-
+apt,1.0,CVE-123-LOW,LOW,2,<some-link-to-nvd>,1.1,-,-
+bash,4.2,CVE-789-CRIT,CRITICAL,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+bash,4.2,CVE-456-CRIT,CRITICAL,9,<some-link-to-nvd>,1.2,-,-
+bash,4.2,CVE-123-CRIT,CRITICAL,8.5,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-789-CRIT,CRITICAL,9.5,<some-link-to-nvd>,1.3,ADVISORY-789-CRIT,<some-link-to-somewhere>
+openssl,1.1.1k,CVE-123-IMP,IMPORTANT,7,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-456-MED,MODERATE,4.9,<some-link-to-nvd>,1.2,-,-
+openssl,1.1.1k,CVE-123-MED,MODERATE,4.5,<some-link-to-nvd>,1.1,-,-
+openssl,1.1.1k,CVE-123-LOW,LOW,2,<some-link-to-nvd>,1.1,-,-
+curl,7.0-rc1,CVE-123-IMP,IMPORTANT,7,<some-link-to-nvd>,1.1,-,-
+curl,7.0-rc1,CVE-789-IMP,IMPORTANT,7,<some-link-to-nvd>,1.3,-,-
+curl,7.0-rc1,CVE-456-IMP,IMPORTANT,6.8,<some-link-to-nvd>,1.2,-,-
+systemd,1.3-debu49,CVE-789-MED,MODERATE,5.2,<some-link-to-nvd>,1.3,-,-
+systemd,1.3-debu49,CVE-456-MED,MODERATE,4.9,<some-link-to-nvd>,1.2,-,-
+systemd,1.3-debu49,CVE-123-MED,MODERATE,4.5,<some-link-to-nvd>,1.1,-,-
diff --git a/roxctl/image/scan/testdata/testComponents.json b/roxctl/image/scan/testdata/testComponents.json
index 55d394c10dbf4..6f4a4a8576005 100755
--- a/roxctl/image/scan/testdata/testComponents.json
+++ b/roxctl/image/scan/testdata/testComponents.json
@@ -12,55 +12,76 @@
       {
         "cveId": "CVE-789-CRIT",
         "cveSeverity": "CRITICAL",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "apt",
         "componentVersion": "1.0",
         "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-123-LOW",
+        "cveId": "CVE-789-LOW",
         "cveSeverity": "LOW",
+        "cveCVSS": 2.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "apt",
         "componentVersion": "1.0",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-789-LOW",
+        "cveId": "CVE-123-LOW",
         "cveSeverity": "LOW",
+        "cveCVSS": 2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "apt",
         "componentVersion": "1.0",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-123-CRIT",
+        "cveId": "CVE-789-CRIT",
         "cveSeverity": "CRITICAL",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "bash",
         "componentVersion": "4.2",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
         "cveId": "CVE-456-CRIT",
         "cveSeverity": "CRITICAL",
+        "cveCVSS": 9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "bash",
         "componentVersion": "4.2",
         "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-789-CRIT",
+        "cveId": "CVE-123-CRIT",
         "cveSeverity": "CRITICAL",
+        "cveCVSS": 8.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "bash",
         "componentVersion": "4.2",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       },
       {
         "cveId": "CVE-789-CRIT",
         "cveSeverity": "CRITICAL",
+        "cveCVSS": 9.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "ADVISORY-789-CRIT",
+        "advisoryInfo": "<some-link-to-somewhere>",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.3"
@@ -68,31 +89,43 @@
       {
         "cveId": "CVE-123-IMP",
         "cveSeverity": "IMPORTANT",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-123-MED",
+        "cveId": "CVE-456-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-456-MED",
+        "cveId": "CVE-123-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
-        "componentFixedVersion": "1.2"
+        "componentFixedVersion": "1.1"
       },
       {
         "cveId": "CVE-123-LOW",
         "cveSeverity": "LOW",
+        "cveCVSS": 2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "openssl",
         "componentVersion": "1.1.1k",
         "componentFixedVersion": "1.1"
@@ -100,50 +133,68 @@
       {
         "cveId": "CVE-123-IMP",
         "cveSeverity": "IMPORTANT",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
         "componentFixedVersion": "1.1"
       },
       {
-        "cveId": "CVE-456-IMP",
+        "cveId": "CVE-789-IMP",
         "cveSeverity": "IMPORTANT",
+        "cveCVSS": 7,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
-        "componentFixedVersion": "1.2"
+        "componentFixedVersion": "1.3"
       },
       {
-        "cveId": "CVE-789-IMP",
+        "cveId": "CVE-456-IMP",
         "cveSeverity": "IMPORTANT",
+        "cveCVSS": 6.8,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "curl",
         "componentVersion": "7.0-rc1",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-123-MED",
+        "cveId": "CVE-789-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 5.2,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
-        "componentFixedVersion": "1.1"
+        "componentFixedVersion": "1.3"
       },
       {
         "cveId": "CVE-456-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.9,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
         "componentFixedVersion": "1.2"
       },
       {
-        "cveId": "CVE-789-MED",
+        "cveId": "CVE-123-MED",
         "cveSeverity": "MODERATE",
+        "cveCVSS": 4.5,
         "cveInfo": "<some-link-to-nvd>",
+        "advisoryId": "",
+        "advisoryInfo": "",
         "componentName": "systemd",
         "componentVersion": "1.3-debu49",
-        "componentFixedVersion": "1.3"
+        "componentFixedVersion": "1.1"
       }
     ]
   }
diff --git a/roxctl/image/scan/testdata/testComponents.txt b/roxctl/image/scan/testdata/testComponents.txt
index b3d7fc2cb3848..505fab74416ff 100755
--- a/roxctl/image/scan/testdata/testComponents.txt
+++ b/roxctl/image/scan/testdata/testComponents.txt
@@ -1,40 +1,40 @@
 Scan results for image: nginx:test
 (TOTAL-COMPONENTS: 5, TOTAL-VULNERABILITIES: 11, LOW: 2, MODERATE: 3, IMPORTANT: 3, CRITICAL: 3)
 
-+-----------+------------+--------------+-----------+--------------------+---------------+
-| COMPONENT |  VERSION   |     CVE      | SEVERITY  |        LINK        | FIXED VERSION |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|    apt    |    1.0     | CVE-789-CRIT | CRITICAL  | <some-link-to-nvd> |      1.3      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-LOW  |    LOW    | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-LOW  |    LOW    | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|   bash    |    4.2     | CVE-123-CRIT | CRITICAL  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-CRIT | CRITICAL  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-CRIT | CRITICAL  | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|  openssl  |   1.1.1k   | CVE-789-CRIT | CRITICAL  | <some-link-to-nvd> |      1.3      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-IMP  | IMPORTANT | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-MED  | MODERATE  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-MED  | MODERATE  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-123-LOW  |    LOW    | <some-link-to-nvd> |      1.1      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|   curl    |  7.0-rc1   | CVE-123-IMP  | IMPORTANT | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-IMP  | IMPORTANT | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-IMP  | IMPORTANT | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
-|  systemd  | 1.3-debu49 | CVE-123-MED  | MODERATE  | <some-link-to-nvd> |      1.1      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-456-MED  | MODERATE  | <some-link-to-nvd> |      1.2      |
-|           |            +--------------+-----------+--------------------+---------------+
-|           |            | CVE-789-MED  | MODERATE  | <some-link-to-nvd> |      1.3      |
-+-----------+------------+--------------+-----------+--------------------+---------------+
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+| COMPONENT |  VERSION   |     CVE      | SEVERITY  | CVSS |        LINK        | FIXED VERSION |     ADVISORY      |      ADVISORY LINK       |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|    apt    |    1.0     | CVE-789-CRIT | CRITICAL  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-789-LOW  |    LOW    | 2.5  | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-LOW  |    LOW    |  2   | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|   bash    |    4.2     | CVE-789-CRIT | CRITICAL  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-CRIT | CRITICAL  |  9   | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-CRIT | CRITICAL  | 8.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|  openssl  |   1.1.1k   | CVE-789-CRIT | CRITICAL  | 9.5  | <some-link-to-nvd> |      1.3      | ADVISORY-789-CRIT | <some-link-to-somewhere> |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-IMP  | IMPORTANT |  7   | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-MED  | MODERATE  | 4.9  | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-MED  | MODERATE  | 4.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-LOW  |    LOW    |  2   | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|   curl    |  7.0-rc1   | CVE-123-IMP  | IMPORTANT |  7   | <some-link-to-nvd> |      1.1      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-789-IMP  | IMPORTANT |  7   | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-IMP  | IMPORTANT | 6.8  | <some-link-to-nvd> |      1.2      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|  systemd  | 1.3-debu49 | CVE-789-MED  | MODERATE  | 5.2  | <some-link-to-nvd> |      1.3      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-456-MED  | MODERATE  | 4.9  | <some-link-to-nvd> |      1.2      |         -         |            -             |
+|           |            +--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+
+|           |            | CVE-123-MED  | MODERATE  | 4.5  | <some-link-to-nvd> |      1.1      |         -         |            -             |
++-----------+------------+--------------+-----------+------+--------------------+---------------+-------------------+--------------------------+


Reviews:
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T19:07:46Z
user: login: sourcery-ai[bot]
body: Hey @RTann - I've reviewed your changes and they look great!

<details>
<summary>Here's what I looked at during the review</summary>

- 🟢 **General issues**: all looks good
- 🟢 **Security**: all looks good
- 🟢 **Testing**: all looks good
- 🟢 **Complexity**: all looks good
- 🟢 **Documentation**: all looks good
</details>

***

<details>
<summary>Sourcery is free for open source - if you like our reviews please consider sharing them ✨</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https://sourcery.ai)
- [Facebook](https://www.facebook.com/sharer/sharer.php?u=https://sourcery.ai)

</details>

<sub>
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
</sub>
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T19:15:29Z
user: login: sourcery-ai[bot]
body: Hey @RTann - I've reviewed your changes - here's some feedback:

- In getVulnerabilityJSON you call vulnerability.GetAdvisory().GetName() and GetLink() without checking if Advisory is nil—please guard against a nil pointer to avoid panics when a CVE has no advisory.
- The CVSS and advisory JSONPath expressions are duplicated in scan.go and tabularprinter_factory.go—consider extracting them into a shared const or helper to reduce maintenance overhead.

<details>
<summary>Here's what I looked at during the review</summary>

- 🟡 **General issues**: 1 issue found
- 🟢 **Security**: all looks good
- 🟢 **Testing**: all looks good
- 🟢 **Complexity**: all looks good
- 🟢 **Documentation**: all looks good
</details>

***

<details>
<summary>Sourcery is free for open source - if you like our reviews please consider sharing them ✨</summary>

- [X](https://twitter.com/intent/tweet?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20got%20an%20instant%20code%20review%20from%20%40SourceryAI%2C%20and%20it%20was%20brilliant%21%20It%27s%20free%20for%20open%20source%20and%20has%20a%20free%20trial%20for%20private%20code.%20Check%20it%20out%20https%3A//sourcery.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https://sourcery.ai)
- [Facebook](https://www.facebook.com/sharer/sharer.php?u=https://sourcery.ai)

</details>

<sub>
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
</sub>
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T21:41:46Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T21:48:33Z
user: login: sourcery-ai[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T21:48:47Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-28T21:49:54Z
user: login: dashrews78
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T09:52:02Z
user: login: dashrews78
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T09:52:07Z
user: login: janisz
body: Need a rebase :( 
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T09:54:47Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T15:24:46Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T15:25:08Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T15:39:27Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T16:30:23Z
user: login: dcaravel
body: LGTM
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-29T21:45:16Z
user: login: janisz
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-30T11:31:38Z
user: login: janisz
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-30T11:32:18Z
user: login: RTann
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-30T21:14:01Z

Review comments:
path: roxctl/image/scan/scan.go
user: login: RTann
body: I don't know much about SARIF, so I just guessed this is ok here
created_at: 2025-05-28T19:07:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,7 +67,10 @@ type cveJSONStructure struct {
 type cveVulnerabilityJSON struct {
 	CveID                 string      `json:"cveId"`
 	CveSeverity           cveSeverity `json:"cveSeverity"`
+	CveCVSS               float32     `json:"cveCVSS"`
path: roxctl/image/scan/cve.go
user: login: sourcery-ai[bot]
body: **suggestion:** Consider using float64 for CVSS scores

Using float64 aligns with Go's default for JSON numbers and helps prevent precision issues during marshaling. Unless float32 is required, float64 is preferable for consistency.

Suggested implementation:

```golang
	CveCVSS               float64     `json:"cveCVSS"`

```

```golang
			CveCVSS:               float64(vulnerability.GetCvss()),

```
created_at: 2025-05-28T21:41:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,7 +67,10 @@ type cveJSONStructure struct {
 type cveVulnerabilityJSON struct {
 	CveID                 string      `json:"cveId"`
 	CveSeverity           cveSeverity `json:"cveSeverity"`
+	CveCVSS               float32     `json:"cveCVSS"`
path: roxctl/image/scan/cve.go
user: login: RTann
body: this number is expected to only have 2 significant figures (like x.y), so there isn't really a need for that much precision. Plus float32 is smaller, which is nice
created_at: 2025-05-28T21:48:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,7 +67,10 @@ type cveJSONStructure struct {
 type cveVulnerabilityJSON struct {
 	CveID                 string      `json:"cveId"`
 	CveSeverity           cveSeverity `json:"cveSeverity"`
+	CveCVSS               float32     `json:"cveCVSS"`
path: roxctl/image/scan/cve.go
user: login: sourcery-ai[bot]
body: Sounds good—if we’re only ever using one decimal place and want to keep the footprint smaller, float32 is perfectly acceptable here. I’ve marked this suggestion as resolved. Thanks for the clarification!
created_at: 2025-05-28T21:48:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -67,7 +67,10 @@ type cveJSONStructure struct {
 type cveVulnerabilityJSON struct {
 	CveID                 string      `json:"cveId"`
 	CveSeverity           cveSeverity `json:"cveSeverity"`
+	CveCVSS               float32     `json:"cveCVSS"`
path: roxctl/image/scan/cve.go
user: login: RTann
body: Thanks for the review
created_at: 2025-05-28T21:49:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -13,25 +13,31 @@ import (
 
 var (
 	// Default headers to use when printing tabular output.
-	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "LINK", "FIXED_VERSION"}
+	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "CVSS", "LINK", "FIXED_VERSION", "ADVISORY", "ADVISORY_LINK"}
path: roxctl/common/printer/tabularprinter_factory.go
user: login: janisz
body: Do we need both `LINK` and `ADVISORY_LINK` same with `CVE` and `ADVISORY`
created_at: 2025-05-29T09:51:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -119,6 +122,9 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
 			CveInfo:               vulnerability.GetLink(),
+			CveCVSS:               vulnerability.GetCvss(),
path: roxctl/image/scan/cve.go
user: login: dashrews78
body: biggest nit ever:  Everywhere else you put CVSS above its link.  For code consistency you could do that here as well.
created_at: 2025-05-29T09:52:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -119,6 +122,9 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
 			CveInfo:               vulnerability.GetLink(),
+			CveCVSS:               vulnerability.GetCvss(),
path: roxctl/image/scan/cve.go
user: login: janisz
body: Should we use it in sorting? I think higher score should be at the top of the same severity group
created_at: 2025-05-29T09:53:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -13,25 +13,31 @@ import (
 
 var (
 	// Default headers to use when printing tabular output.
-	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "LINK", "FIXED_VERSION"}
+	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "CVSS", "LINK", "FIXED_VERSION", "ADVISORY", "ADVISORY_LINK"}
path: roxctl/common/printer/tabularprinter_factory.go
user: login: RTann
body: Yes, they are all different. Here is an example line:

```
+-----------------------------+----------------------------------------------------+------------------+-----------+------+---------------------------------------------------------+----------------------------------------------------+-----------------+--------------------------------------------------+
|          COMPONENT          |                      VERSION                       |       CVE        | SEVERITY  | CVSS |                          LINK                           |                   FIXED VERSION                    |    ADVISORY     |                  ADVISORY LINK                   |
+-----------------------------+----------------------------------------------------+------------------+-----------+------+---------------------------------------------------------+----------------------------------------------------+-----------------+--------------------------------------------------+
|      emacs-filesystem       |                    1:27.2-9.el9                    |  CVE-2025-1244   | IMPORTANT | 8.8  |  https://access.redhat.com/security/cve/CVE-2025-1244   |                 1:27.2-11.el9_5.1                  | RHSA-2025:1915  | https://access.redhat.com/errata/RHSA-2025:1915  |
|                             |                                                    +------------------+-----------+------+---------------------------------------------------------+----------------------------------------------------+-----------------+--------------------------------------------------+
```
created_at: 2025-05-29T15:24:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -119,6 +122,9 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
 			CveInfo:               vulnerability.GetLink(),
+			CveCVSS:               vulnerability.GetCvss(),
path: roxctl/image/scan/cve.go
user: login: RTann
body: that's fair. I'll add that
created_at: 2025-05-29T15:25:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -119,6 +122,9 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
 			CveInfo:               vulnerability.GetLink(),
+			CveCVSS:               vulnerability.GetCvss(),
path: roxctl/image/scan/cve.go
user: login: RTann
body: I thrive on nits, so I'm good with this
created_at: 2025-05-29T15:39:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -119,6 +122,9 @@ func getVulnerabilityJSON(vulnerabilities []*storage.EmbeddedVulnerability, comp
 			CveID:                 vulnerability.GetCve(),
 			CveSeverity:           severity,
 			CveInfo:               vulnerability.GetLink(),
+			CveCVSS:               vulnerability.GetCvss(),
path: roxctl/image/scan/cve.go
user: login: RTann
body: Updated the two sort functions [218ec1b](https://github.com/stackrox/stackrox/pull/15468/commits/218ec1b67d0102a4423a963ce921c1631dcc3882)
created_at: 2025-05-29T16:30:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -13,25 +13,31 @@ import (
 
 var (
 	// Default headers to use when printing tabular output.
-	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "LINK", "FIXED_VERSION"}
+	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "CVSS", "LINK", "FIXED_VERSION", "ADVISORY", "ADVISORY_LINK"}
path: roxctl/common/printer/tabularprinter_factory.go
user: login: janisz
body: OK, but then the informations under the link are similar and advisory links to CVE.
created_at: 2025-05-30T11:31:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -13,25 +13,31 @@ import (
 
 var (
 	// Default headers to use when printing tabular output.
-	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "LINK", "FIXED_VERSION"}
+	defaultImageScanHeaders = []string{"COMPONENT", "VERSION", "CVE", "SEVERITY", "CVSS", "LINK", "FIXED_VERSION", "ADVISORY", "ADVISORY_LINK"}
path: roxctl/common/printer/tabularprinter_factory.go
user: login: RTann
body: I don't quite follow this. I'm going to merge this PR since it was approved, but can you explain your concern a bit more?

Currently, we only support Red Hat Advisories (RHSA, RHEA, RHBA). In 4.8, we will stop showing those are the top-level vulnerability ID/name. Instead, we use the CVE identifier and then we have an extra column to list the related RHSA/RHEA/RHBA, if one exists. So the CVE link and the advisory link will be different
created_at: 2025-05-30T21:14:01Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci[bot]
created_at: 2025-05-28T16:16:32Z
body: Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with `/test all`
author_association: NONE
user: login: rhacs-bot
created_at: 2025-05-28T16:46:55Z
body: [//]: # (meta:type=build)

Images are ready for the commit at 218ec1b.

To use with deploy scripts, first `export MAIN_IMAGE_TAG=4.8.x-856-g218ec1b67d`.
author_association: CONTRIBUTOR
user: login: codecov[bot]
created_at: 2025-05-28T18:46:27Z
body: ## [Codecov](https://app.codecov.io/gh/stackrox/stackrox/pull/15468?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 49.25%. Comparing base [(`bc0dc6c`)](https://app.codecov.io/gh/stackrox/stackrox/commit/bc0dc6c734e14a2300a2c8113730d9966fd3b2f4?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) to head [(`218ec1b`)](https://app.codecov.io/gh/stackrox/stackrox/commit/218ec1b67d0102a4423a963ce921c1631dcc3882?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).
> Report is 25 commits behind head on master.

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##           master   #15468   +/-   ##
=======================================
  Coverage   49.25%   49.25%           
=======================================
  Files        2581     2581           
  Lines      189382   189393   +11     
=======================================
+ Hits        93282    93291    +9     
- Misses      88753    88755    +2     
  Partials     7347     7347           
```

| [Flag](https://app.codecov.io/gh/stackrox/stackrox/pull/15468/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) | Coverage Δ | |
|---|---|---|
| [go-unit-tests](https://app.codecov.io/gh/stackrox/stackrox/pull/15468/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox) | `49.25% <100.00%> (+<0.01%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox#carryforward-flags-in-the-pull-request-comment) to find out more.

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/stackrox/stackrox/pull/15468?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=stackrox).

<details><summary> :rocket: New features to boost your workflow: </summary>

- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
author_association: NONE
user: login: RTann
created_at: 2025-05-28T21:37:08Z
body: @sourcery-ai review
author_association: CONTRIBUTOR
user: login: RTann
created_at: 2025-05-28T21:47:42Z
body: > Hey @RTann - I've reviewed your changes - here's some feedback:
> 
> * In getVulnerabilityJSON you call vulnerability.GetAdvisory().GetName() and GetLink() without checking if Advisory is nil—please guard against a nil pointer to avoid panics when a CVE has no advisory.

vulnerability.GetAdvisory() has a built-in nil check, so no need to add another one.

> * The CVSS and advisory JSONPath expressions are duplicated in scan.go and tabularprinter_factory.go—consider extracting them into a shared const or helper to reduce maintenance overhead.

I don't think that's quite true
author_association: CONTRIBUTOR
user: login: janisz
created_at: 2025-05-29T09:48:42Z
body: Do we need to update https://github.com/stackrox/jenkins-plugin output as well?
author_association: CONTRIBUTOR
user: login: RTann
created_at: 2025-05-29T15:25:55Z
body: > Do we need to update https://github.com/stackrox/jenkins-plugin output as well?

I'll make a ticket and can look into it in a followup. I do not believe that is absolutely required for 4.8.0 at least, though
author_association: CONTRIBUTOR
user: login: RTann
created_at: 2025-05-29T18:22:39Z
body: > https://github.com/stackrox/jenkins-plugin

@janisz https://issues.redhat.com/browse/ROX-29531
author_association: CONTRIBUTOR
user: login: RTann
created_at: 2025-05-29T18:29:30Z
body: /retest
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-30T01:48:47Z
body: @RTann: The following tests **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
ci/prow/ocp-4-18-scanner-v4-install-tests | 218ec1b67d0102a4423a963ce921c1631dcc3882 | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/stackrox_stackrox/15468/pull-ci-stackrox-stackrox-master-ocp-4-18-scanner-v4-install-tests/1928208737676300288) | false | `/test ocp-4-18-scanner-v4-install-tests`
ci/prow/ocp-4-12-scanner-v4-install-tests | 218ec1b67d0102a4423a963ce921c1631dcc3882 | [link](https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/stackrox_stackrox/15468/pull-ci-stackrox-stackrox-master-ocp-4-12-scanner-v4-install-tests/1928208737231704064) | false | `/test ocp-4-12-scanner-v4-install-tests`

[Full PR test history](https://prow.ci.openshift.org/pr-history?org=stackrox&repo=stackrox&pr=15468). [Your PR dashboard](https://prow.ci.openshift.org/pr?query=is:pr+state:open+author:RTann).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
author_association: NONE
user: login: RTann
created_at: 2025-05-30T18:08:45Z
body: /retest
author_association: CONTRIBUTOR