Using postgres:latest as a random example, docker hub reports ~55 vulnerabilities, gitlab ultimate container scan in my pipeline runs and reports approximately the same number of vulnerabilities.
Image content digest is the same for both scans.
Both scans list CVE-xxxx-xxxxx defects in the usual format, but not a single CVE- number matches between them.
I’d never expect an exact match between different scanners, but I must be missing something here, there seems to be zero commonality between them?
1