UNKNOWN CVE severities.

[Alex619829]

Why are there so many "unknown" vulnerability levels?
For example: https://zothub.io/image/golang/tag/1.25

[andaaron]

Hi @Alex619829, "Unknown" corresponds to score "None" in https://www.first.org/cvss/v3.0/specification-document#Qualitative-Severity-Rating-Scale. This is how the Trivy library reports them, and we are sticking to the same convention.

See also https://trivy.dev/docs/latest/scanner/vulnerability/