There's no way to specify what you'll be doing with the container, or how the vuln is triggered, so of course it can't provide useful guidance. The whole CVE re

There's no way to specify what you'll be doing with the container, or how the vuln is triggered, so of course it can't provide useful guidance. The whole CVE report mechanism would have to change to allow low FAR scanning.