Suppress vulnerabilities applying Kubernetes context to scans
Summary
Vex8s is an open-source project that correlates container vulnerabilities with Kubernetes security contexts to determine which CVEs are exploitable in a cluster and generates VEX suppression documents. It classifies CVEs into exploitation classes, uses an embedded ONNX model or Gemini classifier to predict exploitability, and maps exploitation categories to Kubernetes settings that mitigate risk. The system analyzes Kubernetes manifests to assess if the relevant mitigation settings are applied and supports both passive and active scanning workflows using Trivy or Grype.