Trivy is open source. You can check where they get their data from. But I imagine they use this for Debian: https://security-tracker.debian.org/tracker/ https:/

Trivy is open source. You can check where they get their data from. But I imagine they use this for Debian: https://security-tracker.debian.org/tracker/ https://security-tracker.debian.org/tracker/