How do I get Trivy output as JSON?

Run trivy image --format json -o trivy.json . The same flag works for trivy fs . and trivy repo. Add --list-all-pkgs if you want the report to say how many packages were scanned, not just the vulnerable ones. Trivy exits 0 by default; add --exit-code 1 --severity HIGH,CRITICAL in a separate step if the build should fail.

Does it read Grype too?

Yes. Run grype -o json > grype.json and drop the file in. Grype's CVSS score usually sits on the related NVD record rather than the distro record that matched, so the viewer reads both and keeps the score from the highest CVSS version. Grype's Negligible severity is shown as Info.

Why do curl and libcurl4 show the same CVE twice?

Because they are two installed packages built from one source package, and upgrading only one of them leaves the image vulnerable. The advisory list shows each package-and-CVE pair, so the count matches what Trivy reports. The same package found in two places — two jars, two lockfiles — is counted once.

What does “No fix yet” mean for an OS package?

Trivy marked the CVE will_not_fix, fix_deferred, end_of_life or affected, or Grype marked it not-fixed or wont-fix — the distribution has not shipped a patched build. Upgrading the base image may not help; the options are a different base image (distroless, Alpine, a newer release), removing the package, or recording why the risk is accepted.

Which severity does the report use?

The scanner's own label — the one --severity and --fail-on filter by. For OS packages Trivy often uses the distribution's rating, which can differ from the NVD CVSS score shown next to it; a distro rating well below the NVD score is common when the vulnerable code isn't built or reachable in that package. Both are on the report so the difference is visible.

What about misconfigurations, secrets and SARIF?

This viewer lists vulnerabilities. Trivy's Misconfigurations and Secrets results are skipped. If you ran trivy --format sarif, open the file in the SARIF viewer instead. OSV-Scanner, pip-audit and npm, pnpm or yarn audit JSON also work here.

No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish it to Comma — and then you choose who can open it.

Free tool

The image scan, as a report someone can sign off on.

Drop the JSON from trivy image --format json or grype -o json. Get every CVE with its severity, CVSS score and the installed package — OS layer and lockfiles together — plus the version that fixes it or a plain “no fix yet”, then copy a Markdown table for the pull request or send the report to whoever decides whether the image ships.

trivy.json

{
  "SchemaVersion": 2,
  "ArtifactName": "registry.example.com/web:1.4.2",
  "ArtifactType": "container_image",
  "Metadata": {
    "OS": {
      "Family": "debian",
      "Name": "12.2"
    }
  },
  "Results": [
    {
      "Target": "registry.example.com/web:1.4.2 (debian 12.2)",
      "Class": "os-pkgs",
      "Type": "debian",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2023-38545",
          "PkgName": "curl",
          "InstalledVersion": "7.88.1-10+deb12u1",
          "FixedVersion": "7.88.1-10+deb12u4",
          "Status": "fixed",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-38545",
          "Title": "curl: heap based buffer overflow in the SOCKS5 proxy handshake",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-787"
          ],
          "CVSS": {
            "nvd": {
              "V3Score": 9.8
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2023-38545",
          "PkgName": "libcurl4",
          "InstalledVersion": "7.88.1-10+deb12u1",
          "FixedVersion": "7.88.1-10+deb12u4",
          "Status": "fixed",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-38545",
          "Title": "curl: heap based buffer overflow in the SOCKS5 proxy handshake",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-787"
          ],
          "CVSS": {
            "nvd": {
              "V3Score": 9.8
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2023-45853",
          "PkgName": "zlib1g",
          "InstalledVersion": "1:1.2.13.dfsg-1",
          "FixedVersion": "",
          "Status": "will_not_fix",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-45853",
          "Title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-190"
          ],
          "CVSS": {
            "nvd": {
              "V3Score": 9.8
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2023-4911",
          "PkgName": "libc6",
          "InstalledVersion": "2.36-9+deb12u1",
          "FixedVersion": "2.36-9+deb12u3",
          "Status": "fixed",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4911",
          "Title": "glibc: buffer overflow in ld.so leading to privilege escalation",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-787"
          ],
          "CVSS": {
            "nvd": {
              "V3Score": 7.8
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2023-4911",
          "PkgName": "libc-bin",
          "InstalledVersion": "2.36-9+deb12u1",
          "FixedVersion": "2.36-9+deb12u3",
          "Status": "fixed",
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2023-4911",
          "Title": "glibc: buffer overflow in ld.so leading to privilege escalation",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-787"
          ],
          "CVSS": {
            "nvd": {
              "V3Score": 7.8
            }
          }
        }
      ]
    },
    {
      "Target": "app/package-lock.json",
      "Class": "lang-pkgs",
      "Type": "npm",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2024-37890",
          "PkgName": "ws",
          "InstalledVersion": "8.16.0",
          "FixedVersion": "5.2.4, 6.2.3, 7.5.10, 8.17.1",
          "Status": "fixed",
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-37890",
          "Title": "nodejs-ws: denial of service when handling a request with many HTTP headers",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-476"
          ],
          "CVSS": {
            "ghsa": {
              "V3Score": 7.5
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2024-21538",
          "PkgName": "cross-spawn",
          "InstalledVersion": "7.0.3",
          "FixedVersion": "7.0.5, 6.0.6",
          "Status": "fixed",
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-21538",
          "Title": "cross-spawn: regular expression denial of service",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-1333"
          ],
          "CVSS": {
            "ghsa": {
              "V3Score": 7.5
            }
          }
        },
        {
          "VulnerabilityID": "CVE-2024-4068",
          "PkgName": "braces",
          "InstalledVersion": "3.0.2",
          "FixedVersion": "3.0.3",
          "Status": "fixed",
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2024-4068",
          "Title": "braces: fails to limit the number of characters it can handle",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-1050"
          ],
          "CVSS": {
            "ghsa": {
              "V3Score": 7.5
            }
          }
        }
      ]
    },
    {
      "Target": "app/config/.env.example",
      "Class": "secret"
    }
  ]
}

5.2 KBTrivy JSON

Container image scan.html

8 vulnerable packages (3 critical, 5 high) · 8 findings

Publishes this report on Comma: one URL per image that opens without registry or CI access, restricted to named people or your company’s email domain if you like, comments pinned to the exact CVE (“zlib minizip isn’t linked — accept”), and next week’s scan kept as a revision you can diff. Free, no card.

How the scan is read

Trivy writes Results[], one per target: the OS layer (web:1.4.2 (debian 12.2)) and every lockfile, jar or binary it found inside. Each vulnerability is a VulnerabilityID against a PkgName at an InstalledVersion. OS packages are labelled by distro; language packages also show the file they came from.
Grype writes matches[], each a vulnerability, the artifact it matched and its relatedVulnerabilities. Related ids (the CVE behind a GHSA) become aliases, and the CVSS score comes from whichever record carries the newest CVSS version.
Severity is the scanner’s label — what --severity and --fail-on filter by. The CVSS number beside it is Trivy’s score from the same source when there is one, else NVD, else GHSA. They disagree more often than you’d think for OS packages.
Fixes. Trivy’s FixedVersion can list one fix per release line (5.2.4, 6.2.3, 7.5.10, 8.17.1); the report suggests the newest. A Status of will_not_fix, fix_deferred, end_of_life or affected — or Grype’s wont-fix / not-fixed — reads “No fix yet”.
Also read: OSV-Scanner, pip-audit and npm, pnpm or yarn audit JSON, through the same parsers as the pip-audit viewer and npm audit viewer. Trivy SARIF goes to the SARIF viewer.

Getting the JSON

What to scan	Command
Container image	trivy image --format json -o trivy.json web:1.4.2
Only what has a fix	trivy image --ignore-unfixed --format json -o trivy.json web:1.4.2
Repo or directory	trivy fs --format json -o trivy.json .
Image saved as a tar	trivy image --input web.tar --format json -o trivy.json
Grype, image	grype web:1.4.2 -o json > grype.json
Grype, from an SBOM	grype sbom:./bom.cdx.json -o json > grype.json
Count clean packages too	trivy image --list-all-pkgs --format json -o trivy.json web:1.4.2

Trivy exits 0 unless you pass --exit-code 1; Grype exits 1 with --fail-on high when it finds one. Write the JSON in one step and gate in another, so a failing build still leaves a report behind.

The scan is the easy part

Most image findings are base-image noise, and the work is sorting it: rebuild on a newer base, drop a package, or accept a CVE in code the service never runs. That call usually belongs to someone who won’t pull the image or open CI — the release manager, the client’s security team, the auditor collecting evidence. Published to Comma, the report is one link they can read on a phone and comment on CVE by CVE, and an agent can publish it from the pipeline after every build. More in how to share a Trivy report, sharing Grype results and what a GHSA id is.

Questions

How do I get Trivy output as JSON?: Run trivy image --format json -o trivy.json <image>. The same flag works for trivy fs . and trivy repo. Add --list-all-pkgs if you want the report to say how many packages were scanned, not just the vulnerable ones. Trivy exits 0 by default; add --exit-code 1 --severity HIGH,CRITICAL in a separate step if the build should fail.
Does it read Grype too?: Yes. Run grype <image> -o json > grype.json and drop the file in. Grype's CVSS score usually sits on the related NVD record rather than the distro record that matched, so the viewer reads both and keeps the score from the highest CVSS version. Grype's Negligible severity is shown as Info.
Why do curl and libcurl4 show the same CVE twice?: Because they are two installed packages built from one source package, and upgrading only one of them leaves the image vulnerable. The advisory list shows each package-and-CVE pair, so the count matches what Trivy reports. The same package found in two places — two jars, two lockfiles — is counted once.
What does “No fix yet” mean for an OS package?: Trivy marked the CVE will_not_fix, fix_deferred, end_of_life or affected, or Grype marked it not-fixed or wont-fix — the distribution has not shipped a patched build. Upgrading the base image may not help; the options are a different base image (distroless, Alpine, a newer release), removing the package, or recording why the risk is accepted.
Which severity does the report use?: The scanner's own label — the one --severity and --fail-on filter by. For OS packages Trivy often uses the distribution's rating, which can differ from the NVD CVSS score shown next to it; a distro rating well below the NVD score is common when the vulnerable code isn't built or reachable in that package. Both are on the report so the difference is visible.
What about misconfigurations, secrets and SARIF?: This viewer lists vulnerabilities. Trivy's Misconfigurations and Secrets results are skipped. If you ran trivy --format sarif, open the file in the SARIF viewer instead. OSV-Scanner, pip-audit and npm, pnpm or yarn audit JSON also work here.
Is my scan uploaded?: No. The JSON is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish it to Comma — and then you choose who can open it.