[WIP] feat: print vulns with grype using CVE instead of GHSA

[Andreagit97]

docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  anchore/grype:v0.112.0  quay.io/stackstate/zookeeper:3.9.5-7c9dc1f5-main-28

without the --by-cve flag

NAME          INSTALLED           FIXED IN              TYPE          VULNERABILITY        SEVERITY  EPSS           RISK   
jetty-http    9.4.58.v20250814    12.0.12               java-archive  GHSA-qh8g-58pp-2wxh  Medium    1.1% (78th)    0.5    
liblzma5      5.4.1-150600.3.3.1  0:5.4.1-150600.3.6.1  rpm           CVE-2026-34743       High      < 0.1% (18th)  < 0.1  
logback-core  1.3.15              1.3.16                java-archive  GHSA-25qh-j22f-pwp8  Medium    < 0.1% (19th)  < 0.1  
jetty-http    9.4.58.v20250814                          java-archive  GHSA-355h-qmc2-wpwf  High      < 0.1% (7th)   < 0.1  
netty-codec   4.1.130.Final       4.1.133.Final         java-archive  GHSA-mj4r-2hfc-f8p6  High      < 0.1% (4th)   < 0.1  
sed           4.9-150600.1.4      0:4.9-150600.3.3.1    rpm           CVE-2026-5958        Medium    < 0.1% (0th)   < 0.1  
logback-core  1.3.15              1.5.25                java-archive  GHSA-qqpg-mvqg-649v  Low       < 0.1% (2nd)   < 0.1  
jackson-core  2.15.2              2.18.6                java-archive  GHSA-72hv-8253-57qq  Medium    N/A            N/A

With the --by-cve flag

NAME          INSTALLED           FIXED IN              TYPE          VULNERABILITY        SEVERITY  EPSS           RISK   
jetty-http    9.4.58.v20250814    12.0.12               java-archive  CVE-2024-6763        Medium    1.1% (78th)    0.5    
liblzma5      5.4.1-150600.3.3.1  0:5.4.1-150600.3.6.1  rpm           CVE-2026-34743       High      < 0.1% (18th)  < 0.1  
logback-core  1.3.15              1.3.16                java-archive  CVE-2025-11226       Medium    < 0.1% (19th)  < 0.1  
jetty-http    9.4.58.v20250814                          java-archive  CVE-2026-2332        High      < 0.1% (7th)   < 0.1  
netty-codec   4.1.130.Final       4.1.133.Final         java-archive  CVE-2026-42583       High      < 0.1% (4th)   < 0.1  
sed           4.9-150600.1.4      0:4.9-150600.3.3.1    rpm           CVE-2026-5958        Medium    < 0.1% (0th)   < 0.1  
logback-core  1.3.15              1.5.25                java-archive  CVE-2026-1225        Low       < 0.1% (2nd)   < 0.1  
jackson-core  2.15.2              2.18.6                java-archive  GHSA-72hv-8253-57qq  Medium    N/A            N/A

[Andreagit97]

Unfortunately i see the dedup is still broken

  - CVE-2026-2332 [HIGH] jetty-http [grype]
  - CVE-2026-2332 [HIGH] org.eclipse.jetty:jetty-http [trivy]
  - CVE-2026-34743 [HIGH] liblzma5 [grype]
  - CVE-2026-42583 [HIGH] io.netty:netty-codec [trivy]
  - CVE-2026-42583 [HIGH] netty-codec [grype]