"Vulnerabilities" column always shows wrong number in "Details" section

Environment

NeuVector Version(s): 5.6.0-rc3
Scanner: v4224

To Reproduce

Upgrade to nv 5.6.0-rc3
Go to Registries page
Create a registry (ex: https://quay.io/nvlab/library-open-liberty:18.0.0.4-javaee7-java8-openj9 )
Scan it and wait for Finished
Go to check "Vulnerabilities" column in "Details" section
Find it shows 0, 0, 0 (but it actually has vuls) -> Bug!!!
Click the detail and you will find it shows correct vul numbers (ex: 51, 245, 151)
Go to other page and then go back to Registries page
Find it changes to show different numbers (ex: 0, 296, 151) instead of 0, 0, 0 (but it's still incorrect critical and incorrect high numbers; it doesn't split the critical number from high number) -> This is also a bug, too!

Others:
You could refer to the video below.
https://github.com/user-attachments/assets/c964aed1-cfe5-4eba-a8f9-0847cdb85764

Expected behavior

It needs to always show correct numbers

@xingzhang-suse

cc: @xingzhang-suse @selvamt94

@xingzhang-suse

Hi @xingzhang-suse ,

if I run the repro steps above with "fresh install 5.6.0-rc3" in Step 1, then here's the result:

At Step 6 -> it still shows 0, 0, 0 (but it actually has vuls) -> Bug!!!

At Step 9 -> it shows 51, 245, 151 -> which is correct!

So it looks like the bus are slightly different between "fresh install 5.6.0-rc3" and "upgrade",
But they are still bugs by either way.

cc: @selvamt94

It looks like a bug on UI.
From controller debug logs, the last 3 called GET(/v1/scan/registry/:name/images) return payload as followed:

The last 3rd called API returns (still scanning status)

{
    "images": [
        {
            "repository": "nvlab/library-open-liberty",
            "tag": "18.0.0.4-javaee7-java8-openj9",
            ........
            "status": "scanning",
            "critical": 0,
            "high": 0,
            "medium": 0,
            "result": "",
        }
    ]
}

The last 2nd called API returns (still scanning status)

{
    "images": [
        {
            "repository": "nvlab/library-open-liberty",
            "tag": "18.0.0.4-javaee7-java8-openj9",
            ........
            "status": "finished",
            "critical": 51,
            "high": 245,
            "medium": 151,
            "result": "succeeded",
        }
    ]
}

The last called API returns (returns finished status)

{
    "images": [
        {
            "repository": "nvlab/library-open-liberty",
            "tag": "18.0.0.4-javaee7-java8-openj9",
            ...........
            "status": "finished",
            "critical": 51,
            "high": 245,
            "medium": 151,
            "result": "succeeded",
        }
    ]
}

In other words, UI should get "status": "finished" & "critical": 51, "high": 245, "medium": 151, in the same last-called response payload.
However, UI knows to display Finished but not correct critical/high/medium CVEs numbers.
Here are the captured UI network activity from browser dev tool:

Last second call

Last call

Strangely if user then clicks another page & click Registries page again, the correct critical/high/medium CVEs numbers are displayed.

I think this is not a blocking issue for 5.6.0 release
After the scan is finished, if user clicks another page & click Registries page again, the correct critical/high/medium CVEs numbers are displayed.

This is an old bug in UI (Design issue). There is not event trigger to relooad the details data when the registry table state has any change.
The details data is loaded only once when the detail table created.
Due to it is not a blocker and we have to tackle it by redesign the workflow, I suggest to push it after 5.6.0 release.

fixed neuvector#1272 [bug] "Vulnerabilities" column always shows wron…

@xingzhang-suse

Hi @xingzhang-suse and @lsongsuse ,
as we discussed, it still happens with 5.6.2-rc2.
please kindly check, thx.

fixed neuvector#1272 [bug] "Vulnerabilities" column always shows wron…

fixed #1272 [bug] "Vulnerabilities" column always shows wrong number …

This issue happens on many UI pages. QA needs to verify all of them

@williamshen9999

Hi @williamshen9999 , please verify the issue on the Release 5.6 build. The fix is now included in that build, and it has been tested and confirmed working on our end.

@Bin0089

This issue happens on many UI pages. QA needs to verify all of them

@Bin0089 I believe the behavior you are referring to is the auto-refresh issue tracked in #1310 which is different from the count bug in this #1272.

Verify with nv 5.6.2 + scanner v4287, pass. Thanks for help.

At Step 6 -> it will show vul counts normally instad of "0, 0, 0" anymore.

Navigation Menu

Repository navigation

"Vulnerabilities" column always shows wrong number in "Details" section #1272

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"Vulnerabilities" column always shows wrong number in "Details" section #1272

Description

Activity

williamshen9999 commented on Jul 11, 2026

williamshen9999 commented on Jul 13, 2026

williamlin-suse commented on Jul 13, 2026

williamlin-suse commented on Jul 13, 2026

xingzhang-suse commented on Jul 14, 2026

williamshen9999 commented on Sep 9, 2026

Bin0089 commented on Sep 17, 2026

lsongsuse commented on Sep 18, 2026

lsongsuse commented on Sep 22, 2026

williamshen9999 commented on Sep 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions