Vulnerabilities
SubImage scans the container images running in your environment, identifies the software packages inside them, and matches those against known CVEs. The result is not just a CVE list: it ties every vulnerability back to the package that carries it, the image that ships it, and the workload actually running it, so you can tell an exploitable production exposure from noise in an image nobody runs.
The data is organized around the question you are actually asking, across three tabs on the Vulnerabilities page.
Action Items
Start here. Action Items is the fix-first view: instead of thousands of CVEs, it shows a short list of concrete updates, each phrased as the work to do.
Update
service-apito fix 34 CVEs across 12 packages.
Each row shows the image, the severity breakdown of what the fix clears, and how many images it affects. A base image chip marks fixes that belong in a base image rather than the application.
Open a row for the remediation detail. The Steps tab lists the changes to make: the target file, the instruction, and the current-to-new version diff, each with a rationale, a confidence level, and the packages driving it. When one fix depends on another (update the base image first), the step links to that linked action item so you can open it directly. The detail also offers View Repo, View Dockerfile, and an Agent Prompt button that copies a ready-to-paste remediation prompt for your coding agent.
Action Items are ordered so the highest-severity, broadest fixes come first. Clearing one base-image action item often resolves CVEs across every image built on it, so check for base-image fixes before chasing individual CVEs.
Vulnerable Packages
Vulnerable Packages pivots on the software rather than the fix. Each row is a package with the count of CVEs it carries, its installed version(s), the fixed version when one exists (or No fix available), and a severity breakdown. Risk chips flag packages that are internet-exposed or that come from a base image.
Filter by severity, platform, cluster, namespace, account, internet exposure, or fixability (fixable vs not fixable) to cut straight to what you can act on. Open a package to see the CVEs it carries, the images that ship it (including a Base Images breakdown when the package is inherited), and where those images are Running on.
CVEs
CVEs is the full catalog, one row per CVE: ID, severity (with the CVSS score beneath), EPSS score, title, published date, and a KEV marker linking to the CISA advisory when the CVE is a Known Exploited Vulnerability.
Search is structured; filter by:
id,severity(CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN),kev(true/false)image,package,account,platformcluster,namespacefor Kubernetes workloads
Open a CVE for the full detail: CVSS score and vector, EPSS score and percentile, KEV date, description, and a View Full Report link to the upstream advisory. Its tabs break down the Packages affected (with installed and fixed versions), the Images that ship them (with Dockerfile and repo links, platforms, and container counts), and Running on: the account, region, and workload where the image actually runs, flagged when the account is internet-exposed.
KEV and EPSS answer "is this being exploited in the wild", CVSS answers "how bad if it is", and the internet-exposed flag answers "can it be reached". A high-CVSS CVE on an image that runs nothing internet-facing is rarely your top priority; a KEV-listed CVE on an internet-exposed workload is.
Visualizing and navigating
Any CVE or package detail has a Visualize button that opens the graph explorer around the affected resources (requires Neo4j read access). Clicking a resource row jumps to its Inventory detail.
How vulnerabilities relate to Issues
Vulnerabilities are one of the raw signals behind Issues. Triage groups related CVEs, usually all the vulnerabilities on one service image, into a single issue with a priority and, where a fix exists, action items. Use the Vulnerabilities page to explore and understand exposure; use the Issues queue to track and route the remediation work.
Programmatic access
The same data is available over MCP: subimageListVulnerabilities, subimageGetVulnerabilitySummary, subimageGetVulnerabilityDetails, subimageListVulnerabilityActionItems, subimageGetVulnerabilityActionItem, and the package tools (subimageListPackages, subimageGetPackageSummary, subimageGetPackageDetails). The subimage-mcp:investigate-cve skill runs a full impact-and-fixability workup for one CVE and can pivot into attack-path exploration on the affected resources. See Connect via MCP.