Report diff's

[MrFlibble007]

Has something changed in how report diff functions work in the last few months? I'm getting the same unfixed alerts come through each day via my webook.

I've tested this with a single machine and see its the same as when its run for multiple.

What I've noticed is that when its doing a diff its comparing the most recent report with the 2nd from first report ever taken - which seems really strange.

I've tried wiping the contents of the results directory and starting again, it didn't help.

What I run after scan and report local.

cat slack_unfixed_alerts.sh 
#!/bin/bash
# diff-plus - New or updated vulnerabilities
/usr/bin/cat /vuls/config_servers.toml /vuls/config_unfixed_alerts_slack.toml > /vuls/docker/config.toml
/usr/bin/cat /vuls/config_databases.toml >> /vuls/docker/config.toml
cd /vuls/docker/
./report.sh -to-slack -cvss-over=8 -format-list -diff-plus

What the output looks like:

Note the Previous json found: /vuls/results/2026-04-25T08-27-25+0000/2fauth-01.json

Using default tag: latest
latest: Pulling from vuls/vuls
Digest: sha256:a10519300da8cd5d053be3a34f921c5f24068cd55ab725e850faf7fbd4942be0
Status: Image is up to date for vuls/vuls:latest
docker.io/vuls/vuls:latest
time="May  1 17:10:49" level=info msg="vuls--build-20260501_053837_6372c4c" 
time="May  1 17:10:49" level=info msg="Validating config..." 
time="May  1 17:10:49" level=info msg="cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/vuls/cve.sqlite3" 
time="May  1 17:10:49" level=info msg="gost.type=sqlite3, gost.url=, gost.SQLite3Path=/vuls/gost.sqlite3" 
time="May  1 17:10:49" level=info msg="cti.type=sqlite3, cti.url=, cti.SQLite3Path=/vuls/go-cti.sqlite3" 
time="May  1 17:10:50" level=info msg="Loaded: /vuls/results/2026-05-01T15-33-21+0000" 
time="May  1 17:10:52" level=info msg="2fauth-01: 1620 CVEs are detected with vuls2" 
time="May  1 17:10:52" level=info msg="2fauth-01: 0 CVEs are detected with CPE" 
time="May  1 17:11:00" level=info msg="2fauth-01: Cyber Threat Intelligences are detected for 0 CVEs" 
time="May  1 17:11:00" level=info msg="Previous json found: /vuls/results/2026-04-25T08-27-25+0000/2fauth-01.json" 
time="May  1 17:11:00" level=info msg="2fauth-01: total 281 CVEs detected" 
time="May  1 17:11:00" level=info msg="2fauth-01: 241 CVEs filtered by --cvss-over=8" 
time="May  1 17:11:00" level=info msg="2fauth-01: 0 CVEs filtered by --confidence-over=80" 
2fauth-01 (debian12)
====================
Total: 40 (Critical:19 High:21 Medium:0 Low:0 ?:0) +40 -0
0/40 Fixed, 2 poc, 0 exploits, 0 kevs, uscert: 0, jpcert: 0 alerts
79 installed

what the results directory looks like:

ls -lt
total 48
drwx------ 2 root root 4096 May  1 16:33 2026-05-01T15-33-21+0000
drwx------ 2 root root 4096 May  1 16:17 2026-05-01T15-17-13+0000
drwx------ 2 root root 4096 May  1 14:09 2026-05-01T12-57-29+0000
drwx------ 2 root root 4096 Apr 30 14:09 2026-04-30T12-57-38+0000
drwx------ 2 root root 4096 Apr 29 14:08 2026-04-29T12-57-26+0000
drwx------ 2 root root 4096 Apr 28 14:08 2026-04-28T12-56-45+0000
drwx------ 2 root root 4096 Apr 27 14:12 2026-04-27T13-02-05+0000
drwx------ 2 root root 4096 Apr 25 20:59 2026-04-25T19-48-34+0000
drwx------ 2 root root 4096 Apr 25 19:32 2026-04-25T18-20-55+0000
drwx------ 2 root root 4096 Apr 25 19:02 2026-04-25T17-52-14+0000
drwx------ 2 root root 4096 Apr 25 09:38 2026-04-25T08-27-25+0000
drwx------ 2 root root 4096 Apr 24 09:33 2026-04-24T08-22-31+0000

Note the 2026-04-25T08-27-25+0000

 find . -name 2fauth-01.json
./2026-05-01T12-57-29+0000/2fauth-01.json
./2026-05-01T15-17-13+0000/2fauth-01.json
./2026-04-29T12-57-26+0000/2fauth-01.json
./2026-04-25T19-48-34+0000/2fauth-01.json
./2026-04-25T08-27-25+0000/2fauth-01.json
./2026-04-25T18-20-55+0000/2fauth-01.json
./2026-04-25T17-52-14+0000/2fauth-01.json
./2026-04-24T08-22-31+0000/2fauth-01.json
./2026-04-27T13-02-05+0000/2fauth-01.json
./2026-04-30T12-57-38+0000/2fauth-01.json
./2026-05-01T15-33-21+0000/2fauth-01.json
./2026-04-28T12-56-45+0000/2fauth-01.json

Any ideas?

Thanks.

[MaineK00n]

Thanks for the very thorough report — the directory listing and the Previous json found log line you included pinpointed this exactly.

Confirmed it's a regression. detector.ListValidJSONDirs is supposed to return result directories newest-first (its doc comment says so, and loadPrevious skips dirs[0] as the current scan and takes dirs[1] as the previous one). In #2415 (Go 1.26 bump) the original descending sort.Slice was modernized to slices.Sort, which sorts ascending — so dirs[0] became the oldest directory and dirs[1] became the second-oldest. That's why your diff always compared against 2026-04-25T08-27-25+0000.

Opened a fix in #2555 that:

• Restores descending sort (matching the sibling reporter.ListValidJSONDirs).
• Adds a regression test built from the exact directory list in this thread — it fails on master and passes with the fix.

Once it's merged you should see Previous json found: point at the second-newest dir (the previous day's scan) instead of an ancient one, and --diff-plus should stop re-sending alerts you've already seen.

[MaineK00n]

The pull request has been merged. If the issue still persists even after using the latest commit, please reopen it and report it again.